Edit tour

Windows Analysis Report
M5vARlA2c4.exe

Overview

General Information

Sample name:	M5vARlA2c4.exe renamed because original name is a hash value
Original sample name:	022acabaf8af0e28844b01f4929ee95c.exe
Analysis ID:	1390286
MD5:	022acabaf8af0e28844b01f4929ee95c
SHA1:	b0096d8c5d45cb7e9e0b3df0b5be5c92669530dc
SHA256:	e76ea7b90a900ed00f982ceeff3e6b1f08956f08f8e00daf59c140f51d0deb2c
Tags:	exenjratRAT
Infos:

Detection

Njrat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Njrat

.NET source code contains potential unpacker

Disables zone checking for all users

Drops PE files to the startup folder

Machine Learning detection for dropped file

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Startup Folder File Write

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Tries to load missing DLLs

Uses 32bit PE files

Yara signature match

Classification

Process Tree

System is w10x64

M5vARlA2c4.exe (PID: 6720 cmdline: C:\Users\user\Desktop\M5vARlA2c4.exe MD5: 022ACABAF8AF0E28844B01F4929EE95C)

M5vARlA2c4.exe (PID: 6340 cmdline: "C:\Users\user\Desktop\M5vARlA2c4.exe" .. MD5: 022ACABAF8AF0E28844B01F4929EE95C)

M5vARlA2c4.exe (PID: 2996 cmdline: "C:\Users\user\Desktop\M5vARlA2c4.exe" .. MD5: 022ACABAF8AF0E28844B01F4929EE95C)

M5vARlA2c4.exe (PID: 6460 cmdline: "C:\Users\user\Desktop\M5vARlA2c4.exe" .. MD5: 022ACABAF8AF0E28844B01F4929EE95C)

Java update.exe (PID: 6168 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe" MD5: 022ACABAF8AF0E28844B01F4929EE95C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
NjRAT	RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.	AQUATIC PANDA Earth Lusca Operation C-Major The Gorgon Group	http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-from-leaked-njw0rm-source-code/ http://blogs.360.cn/post/analysis-of-apt-c-37.html http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered-1.pdf https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ https://asec.ahnlab.com/1369	https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat

Malware Configuration

Threatname: Njrat

{"Install Dir": "TEMP", "Install Name": "Dllhost.exe", "Startup": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Campaign ID": "HacKed", "Version": "Njrat 0.7 Golden By Hassan Amiri", "Network Seprator": "|Hassan|", "Mutex": "Windows Update", "Install Flag": "True"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
M5vARlA2c4.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
M5vARlA2c4.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x7cbd:$a1: get_Registry 0x93e6:$a2: SEE_MASK_NOZONECHECKS 0x91f6:$a3: Download ERROR 0x960e:$a4: cmd.exe /c ping 0 -n 2 & del "
M5vARlA2c4.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x960e:$x1: cmd.exe /c ping 0 -n 2 & del " 0x949c:$x2: schtasks /create /sc minute /mo 1 /tn Server /tr 0x9090:$x3: www.upload.ee/image/ 0x90e8:$x3: www.upload.ee/image/ 0x9144:$x3: www.upload.ee/image/ 0x8d8e:$s1: winmgmts:\\.\root\SecurityCenter2 0x9484:$s2: /Server.exe 0x9218:$s3: Executed As 0x724d:$s5: Stub.exe 0x91f6:$s6: Download ERROR 0x8eb4:$s7: shutdown -r -t 00 0x8d50:$s8: Select * From AntiVirusProduct
M5vARlA2c4.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x93e6:$reg: SEE_MASK_NOZONECHECKS 0x91d2:$msg: Execute ERROR 0x9232:$msg: Execute ERROR 0x960e:$ping: cmd.exe /c ping 0 -n 2 & del

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x7cbd:$a1: get_Registry 0x93e6:$a2: SEE_MASK_NOZONECHECKS 0x91f6:$a3: Download ERROR 0x960e:$a4: cmd.exe /c ping 0 -n 2 & del "
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x960e:$x1: cmd.exe /c ping 0 -n 2 & del " 0x949c:$x2: schtasks /create /sc minute /mo 1 /tn Server /tr 0x9090:$x3: www.upload.ee/image/ 0x90e8:$x3: www.upload.ee/image/ 0x9144:$x3: www.upload.ee/image/ 0x8d8e:$s1: winmgmts:\\.\root\SecurityCenter2 0x9484:$s2: /Server.exe 0x9218:$s3: Executed As 0x724d:$s5: Stub.exe 0x91f6:$s6: Download ERROR 0x8eb4:$s7: shutdown -r -t 00 0x8d50:$s8: Select * From AntiVirusProduct
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x93e6:$reg: SEE_MASK_NOZONECHECKS 0x91d2:$msg: Execute ERROR 0x9232:$msg: Execute ERROR 0x960e:$ping: cmd.exe /c ping 0 -n 2 & del

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1635018211.0000000000192000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000000.1635018211.0000000000192000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x7abd:$a1: get_Registry 0x91e6:$a2: SEE_MASK_NOZONECHECKS 0x8ff6:$a3: Download ERROR 0x940e:$a4: cmd.exe /c ping 0 -n 2 & del "
00000000.00000000.1635018211.0000000000192000.00000002.00000001.01000000.00000003.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x91e6:$reg: SEE_MASK_NOZONECHECKS 0x8fd2:$msg: Execute ERROR 0x9032:$msg: Execute ERROR 0x940e:$ping: cmd.exe /c ping 0 -n 2 & del
00000000.00000002.4095165633.0000000002671000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: M5vARlA2c4.exe PID: 6720	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: M5vARlA2c4.exe PID: 6340	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: M5vARlA2c4.exe PID: 2996	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: Java update.exe PID: 6168	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.M5vARlA2c4.exe.190000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.0.M5vARlA2c4.exe.190000.0.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x7cbd:$a1: get_Registry 0x93e6:$a2: SEE_MASK_NOZONECHECKS 0x91f6:$a3: Download ERROR 0x960e:$a4: cmd.exe /c ping 0 -n 2 & del "
0.0.M5vARlA2c4.exe.190000.0.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x960e:$x1: cmd.exe /c ping 0 -n 2 & del " 0x949c:$x2: schtasks /create /sc minute /mo 1 /tn Server /tr 0x9090:$x3: www.upload.ee/image/ 0x90e8:$x3: www.upload.ee/image/ 0x9144:$x3: www.upload.ee/image/ 0x8d8e:$s1: winmgmts:\\.\root\SecurityCenter2 0x9484:$s2: /Server.exe 0x9218:$s3: Executed As 0x724d:$s5: Stub.exe 0x91f6:$s6: Download ERROR 0x8eb4:$s7: shutdown -r -t 00 0x8d50:$s8: Select * From AntiVirusProduct
0.0.M5vARlA2c4.exe.190000.0.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x93e6:$reg: SEE_MASK_NOZONECHECKS 0x91d2:$msg: Execute ERROR 0x9232:$msg: Execute ERROR 0x960e:$ping: cmd.exe /c ping 0 -n 2 & del

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\Desktop\M5vARlA2c4.exe" .., EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\M5vARlA2c4.exe, ProcessId: 6720, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\M5vARlA2c4.exe, ProcessId: 6720, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\Desktop\M5vARlA2c4.exe" .., EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\M5vARlA2c4.exe, ProcessId: 6720, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update

Snort Signatures

ETPRO TROJAN Win32.FrauDrop.akljo Backdoor Beacon - Source IP: 192.168.2.4 - Destination IP: 3.68.171.119

Timestamp:	192.168.2.43.68.171.11949736169922815696 02/11/24-06:47:39.675578
SID:	2815696
Source Port:	49736
Destination Port:	16992
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.4 - Destination IP: 3.68.171.119

Timestamp:	192.168.2.43.68.171.11949736169922825563 02/11/24-06:47:39.874632
SID:	2825563
Source Port:	49736
Destination Port:	16992
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.68.171.119

Timestamp:	192.168.2.43.68.171.11949729169922033132 02/11/24-06:47:01.754129
SID:	2033132
Source Port:	49729
Destination Port:	16992
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.68.171.119

Timestamp:	192.168.2.43.68.171.11949736169922033132 02/11/24-06:47:39.675578
SID:	2033132
Source Port:	49736
Destination Port:	16992
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.4 - Destination IP: 3.68.171.119

Timestamp:	192.168.2.43.68.171.11949729169922825564 02/11/24-06:47:33.737666
SID:	2825564
Source Port:	49729
Destination Port:	16992
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.4 - Destination IP: 3.68.171.119

Timestamp:	192.168.2.43.68.171.11949736169922825564 02/11/24-06:50:02.578895
SID:	2825564
Source Port:	49736
Destination Port:	16992
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32.FrauDrop.akljo Backdoor Beacon - Source IP: 192.168.2.4 - Destination IP: 3.68.171.119

Timestamp:	192.168.2.43.68.171.11949729169922815696 02/11/24-06:47:01.754129
SID:	2815696
Source Port:	49729
Destination Port:	16992
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 52.28.247.255

Timestamp:	192.168.2.452.28.247.25549738169922033132 02/11/24-06:50:07.531136
SID:	2033132
Source Port:	49738
Destination Port:	16992
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.4 - Destination IP: 3.68.171.119

Timestamp:	192.168.2.43.68.171.11949729169922825563 02/11/24-06:47:01.954776
SID:	2825563
Source Port:	49729
Destination Port:	16992
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32.FrauDrop.akljo Backdoor Beacon - Source IP: 192.168.2.4 - Destination IP: 52.28.247.255

Timestamp:	192.168.2.452.28.247.25549738169922815696 02/11/24-06:50:07.531136
SID:	2815696
Source Port:	49738
Destination Port:	16992
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.4 - Destination IP: 52.28.247.255

Timestamp:	192.168.2.452.28.247.25549738169922825564 02/11/24-06:50:56.577061
SID:	2825564
Source Port:	49738
Destination Port:	16992
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: M5vARlA2c4.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe

Avira: detection malicious, Label: TR/Dropper.Gen7

Found malware configuration

Source: 0.0.M5vARlA2c4.exe.190000.0.unpack

Malware Configuration Extractor: Njrat {"Install Dir": "TEMP", "Install Name": "Dllhost.exe", "Startup": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Campaign ID": "HacKed", "Version": "Njrat 0.7 Golden By Hassan Amiri", "Network Seprator": "|Hassan|", "Mutex": "Windows Update", "Install Flag": "True"}

Multi AV Scanner detection for domain / URL

Source: 6.tcp.eu.ngrok.io

Virustotal: Detection: 12%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	ReversingLabs: Detection: 84%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Virustotal: Detection: 84%			Perma Link

Multi AV Scanner detection for submitted file

Source: M5vARlA2c4.exe	ReversingLabs: Detection: 84%
Source: M5vARlA2c4.exe	Virustotal: Detection: 84%			Perma Link

Yara detected Njrat

Source: Yara match	File source: M5vARlA2c4.exe, type: SAMPLE
Source: Yara match	File source: 0.0.M5vARlA2c4.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1635018211.0000000000192000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4095165633.0000000002671000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: M5vARlA2c4.exe PID: 6720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: M5vARlA2c4.exe PID: 6340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: M5vARlA2c4.exe PID: 2996, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Java update.exe PID: 6168, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, type: DROPPED

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: M5vARlA2c4.exe

Joe Sandbox ML: detected

Source: M5vARlA2c4.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: M5vARlA2c4.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2815696 ETPRO TROJAN Win32.FrauDrop.akljo Backdoor Beacon 192.168.2.4:49729 -> 3.68.171.119:16992
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49729 -> 3.68.171.119:16992
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49729 -> 3.68.171.119:16992
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49729 -> 3.68.171.119:16992
Source: Traffic	Snort IDS: 2815696 ETPRO TROJAN Win32.FrauDrop.akljo Backdoor Beacon 192.168.2.4:49736 -> 3.68.171.119:16992
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49736 -> 3.68.171.119:16992
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49736 -> 3.68.171.119:16992
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49736 -> 3.68.171.119:16992
Source: Traffic	Snort IDS: 2815696 ETPRO TROJAN Win32.FrauDrop.akljo Backdoor Beacon 192.168.2.4:49738 -> 52.28.247.255:16992
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49738 -> 52.28.247.255:16992
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49738 -> 52.28.247.255:16992

Source: global traffic	TCP traffic: 192.168.2.4:49729 -> 3.68.171.119:16992
Source: global traffic	TCP traffic: 192.168.2.4:49738 -> 52.28.247.255:16992

Source: Joe Sandbox View	IP Address: 52.28.247.255 52.28.247.255
Source: Joe Sandbox View	IP Address: 3.68.171.119 3.68.171.119

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: 6.tcp.eu.ngrok.io

E-Banking Fraud

Yara detected Njrat

Source: Yara match	File source: M5vARlA2c4.exe, type: SAMPLE
Source: Yara match	File source: 0.0.M5vARlA2c4.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1635018211.0000000000192000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4095165633.0000000002671000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: M5vARlA2c4.exe PID: 6720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: M5vARlA2c4.exe PID: 6340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: M5vARlA2c4.exe PID: 2996, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Java update.exe PID: 6168, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: M5vARlA2c4.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: M5vARlA2c4.exe, type: SAMPLE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: M5vARlA2c4.exe, type: SAMPLE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.0.M5vARlA2c4.exe.190000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.0.M5vARlA2c4.exe.190000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.0.M5vARlA2c4.exe.190000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000000.1635018211.0000000000192000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000000.1635018211.0000000000192000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group

Source: C:\Users\user\Desktop\M5vARlA2c4.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Code function: 0_2_00C3A828	0_2_00C3A828
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Code function: 0_2_00C3D698	0_2_00C3D698
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Code function: 0_2_00C3E3E8	0_2_00C3E3E8
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Code function: 0_2_00C3A7D7	0_2_00C3A7D7
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Code function: 0_2_00C35A63	0_2_00C35A63
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Code function: 0_2_04B5AC50	0_2_04B5AC50
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Code function: 0_2_04B59340	0_2_04B59340

Source: M5vARlA2c4.exe, 00000000.00000002.4093307381.0000000000537000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs M5vARlA2c4.exe
Source: M5vARlA2c4.exe, 00000000.00000002.4093489159.000000000076E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs M5vARlA2c4.exe

Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Section loaded: wldp.dll	Jump to behavior

Source: M5vARlA2c4.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: M5vARlA2c4.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: M5vARlA2c4.exe, type: SAMPLE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: M5vARlA2c4.exe, type: SAMPLE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.0.M5vARlA2c4.exe.190000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.0.M5vARlA2c4.exe.190000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.M5vARlA2c4.exe.190000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000000.00000000.1635018211.0000000000192000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000000.1635018211.0000000000192000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan

Source: classification engine

Classification label: mal100.phis.troj.adwa.evad.winEXE@5/4@2/2

Source: C:\Users\user\Desktop\M5vARlA2c4.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Mutant created: \Sessions\1\BaseNamedObjects\Windows Update

Source: M5vARlA2c4.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: M5vARlA2c4.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\M5vARlA2c4.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: M5vARlA2c4.exe	ReversingLabs: Detection: 84%
Source: M5vARlA2c4.exe	Virustotal: Detection: 84%

Source: C:\Users\user\Desktop\M5vARlA2c4.exe

File read: C:\Users\user\Desktop\M5vARlA2c4.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\M5vARlA2c4.exe C:\Users\user\Desktop\M5vARlA2c4.exe
Source: unknown	Process created: C:\Users\user\Desktop\M5vARlA2c4.exe "C:\Users\user\Desktop\M5vARlA2c4.exe" ..
Source: unknown	Process created: C:\Users\user\Desktop\M5vARlA2c4.exe "C:\Users\user\Desktop\M5vARlA2c4.exe" ..
Source: unknown	Process created: C:\Users\user\Desktop\M5vARlA2c4.exe "C:\Users\user\Desktop\M5vARlA2c4.exe" ..
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe"

Source: C:\Users\user\Desktop\M5vARlA2c4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: M5vARlA2c4.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: M5vARlA2c4.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: M5vARlA2c4.exe, OK.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Java update.exe.0.dr, OK.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\M5vARlA2c4.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe

Jump to dropped file

Boot Survival

Drops PE files to the startup folder

Source: C:\Users\user\Desktop\M5vARlA2c4.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe

Jump to dropped file

Source: C:\Users\user\Desktop\M5vARlA2c4.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe

Jump to behavior

Source: C:\Users\user\Desktop\M5vARlA2c4.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe			Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe\:Zone.Identifier:$DATA			Jump to behavior

Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows Update	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows Update	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Windows Update	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Windows Update	Jump to behavior

Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Memory allocated: C30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Memory allocated: 2670000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Memory allocated: 24A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Memory allocated: 6D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Memory allocated: 2390000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Memory allocated: 2220000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Memory allocated: 12F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Memory allocated: 2F00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Memory allocated: 2C60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Memory allocated: 1540000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Memory allocated: 3050000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Memory allocated: 2E90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Memory allocated: D10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Memory allocated: 27C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Memory allocated: 47C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Window / User API: threadDelayed 901	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Window / User API: threadDelayed 2956	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Window / User API: threadDelayed 5164	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Window / User API: foregroundWindowGot 664	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Window / User API: foregroundWindowGot 700	Jump to behavior

Source: C:\Users\user\Desktop\M5vARlA2c4.exe TID: 4124	Thread sleep count: 901 > 30	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe TID: 4124	Thread sleep time: -90100s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe TID: 6748	Thread sleep count: 2956 > 30	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe TID: 6748	Thread sleep time: -2956000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe TID: 6748	Thread sleep count: 5164 > 30	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe TID: 6748	Thread sleep time: -5164000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe TID: 5700	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe TID: 6848	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe TID: 6676	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe TID: 6648	Thread sleep count: 41 > 30	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe TID: 4956	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe TID: 1608	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe TID: 4456	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe TID: 4484	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe TID: 6792	Thread sleep count: 44 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe TID: 2500	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe TID: 3448	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: M5vARlA2c4.exe, 00000000.00000002.4093489159.0000000000809000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\M5vARlA2c4.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\M5vARlA2c4.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/03 \| 22:56:29 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/13 \| 18:58:18 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 18:41:38 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 04:46:05 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 17:33:34 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 18:50:52 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 06:49:42 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/30 \| 15:11:10 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/14 \| 19:33:25 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4095165633.0000000002BC4000.00000004.00000800.00020000.00000000.sdmp, M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 12:50:40 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/16 \| 00:22:30 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/16 \| 23:36:46 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 18:20:14 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/03 \| 23:12:26 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 10:02:27 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/22 \| 14:11:15 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/26 \| 23:04:52 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 01:24:02 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/16 \| 00:06:23 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/03 \| 23:52:23 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 10:22:30 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 11:59:20 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 19:26:51 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/16 \| 01:18:23 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 04:51:23 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 19:22:55 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/09 \| 00:06:55 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 11:34:30 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/05/02 \| 03:59:03 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/15 \| 11:15:52 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/03 \| 23:23:15 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 14:02:30 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/08 \| 23:56:35 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/21 \| 06:29:52 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 15:10:34 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/24 \| 02:25:11 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 00:26:33 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/05/02 \| 05:00:44 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/20 \| 10:43:43 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/15 \| 11:21:15 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 11:59:50 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/04 \| 16:16:18 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/26 \| 06:59:30 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 14:04:05 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/19 \| 19:21:31 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 00:47:57 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 05:19:38 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 19:17:37 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/13 \| 19:07:22 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 05:02:02 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/15 \| 11:10:26 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 10:42:24 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 06:00:47 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 18:05:37 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/17 \| 15:55:34 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/21 \| 23:05:57 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/06 \| 19:43:55 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 14:47:44 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 05:03:32 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/26 \| 23:40:53 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/25 \| 16:11:36 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 11:51:28 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 11:07:34 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/30 \| 00:29:28 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/16 \| 23:35:16 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/21 \| 22:57:44 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 10:27:47 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 19:28:26 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/30 \| 15:09:34 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 01:23:48 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/24 \| 02:32:04 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/08 \| 23:59:01 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 00:19:40 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 14:22:24 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/13 \| 19:22:38 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/21 \| 06:15:21 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 17:39:05 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/24 \| 02:53:28 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/27 \| 20:01:08 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 18:37:11 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/28 \| 10:39:43 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/02 \| 12:39:41 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 19:07:02 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/16 \| 01:07:34 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 00:51:45 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/15 \| 11:26:41 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 14:01:00 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/05/02 \| 04:46:59 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/21 \| 06:32:10 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/17 \| 15:12:32 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 06:48:12 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/13 \| 20:47:33 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 01:01:42 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 05:16:33 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 11:21:03 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/08 \| 23:24:22 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 06:46:15 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/06 \| 05:02:09 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 12:18:26 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/28 \| 10:48:20 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 10:24:05 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/12 \| 15:56:00 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/03 \| 23:34:41 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 14:06:17 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4095165633.0000000002BC4000.00000004.00000800.00020000.00000000.sdmp, M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 13:04:24 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 18:17:56 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/24 \| 02:23:27 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 17:36:00 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 05:07:19 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 00:28:08 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 01:30:50 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/05/02 \| 05:06:15 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/13 \| 20:45:49 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 01:07:50 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/16 \| 00:46:59 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/15 \| 11:34:16 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/12 \| 16:08:48 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 18:57:05 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/24 \| 03:08:40 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 15:02:11 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 06:33:14 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/08 \| 23:30:33 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/15 \| 11:33:34 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/24 \| 03:08:03 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 06:50:03 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/03 \| 23:48:35 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/13 \| 20:17:32 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 11:25:16 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/26 \| 23:32:30 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/08 \| 23:05:49 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 02:54:16 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 10:44:36 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/14 \| 19:54:10 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 11:25:53 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 18:07:21 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/17 \| 15:27:56 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/05/02 \| 04:09:00 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/08 \| 23:53:30 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/30 \| 15:19:41 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/16 \| 00:39:18 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 18:34:08 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/24 \| 03:28:34 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 11:50:46 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/13 \| 20:16:02 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/28 \| 21:13:21 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/03 \| 23:35:34 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/17 \| 15:42:33 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 10:29:59 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 12:05:21 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 14:31:29 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/29 \| 09:09:40 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 12:07:15 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 11:40:30 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/03 \| 23:11:44 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 01:27:07 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/28 \| 20:17:27 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/16 \| 00:29:31 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/15 \| 11:13:40 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 12:09:38 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/13 \| 07:31:43 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/08 \| 23:48:12 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 05:57:23 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 12:27:03 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 00:15:07 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 11:43:53 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 05:51:04 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/13 \| 20:15:59 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/14 \| 19:51:44 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/29 \| 23:32:04 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/13 \| 19:38:53 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/16 \| 00:59:21 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 05:15:03 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/09 \| 00:25:19 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 18:07:49 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/17 \| 15:38:45 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 17:55:12 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 00:14:14 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 10:04:11 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/08 \| 23:26:45 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/19 \| 19:38:19 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/28 \| 10:48:48 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/05/02 \| 05:05:22 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/14 \| 20:02:56 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 04:38:30 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/16 \| 00:33:47 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 01:29:56 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/13 \| 19:12:03 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 07:14:59 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/08 \| 23:45:46 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 18:27:52 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/03 \| 23:39:30 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/08 \| 23:22:49 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/19 \| 19:36:55 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 12:15:08 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 17:51:16 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/08 \| 23:12:03 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/17 \| 15:14:44 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 11:08:16 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/28 \| 18:51:21 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/30 \| 00:08:52 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/19 \| 19:16:50 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 12:15:10 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/12 \| 15:55:57 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 18:00:48 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 12:00:32 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/09 \| 00:28:33 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/30 \| 14:40:00 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 06:50:51 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4095165633.0000000002BC4000.00000004.00000800.00020000.00000000.sdmp, M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 12:33:03 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/29 \| 23:51:53 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 19:47:27 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/14 \| 19:53:56 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/09 \| 00:36:08 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/13 \| 18:39:54 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 04:42:46 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/20 \| 10:42:50 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/15 \| 11:23:27 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/30 \| 00:17:09 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 18:51:45 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/05/02 \| 04:06:34 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/21 \| 06:25:08 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/24 \| 02:36:00 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 00:47:09 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4095165633.0000000002BC4000.00000004.00000800.00020000.00000000.sdmp, M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 12:58:23 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/24 \| 03:17:45 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/15 \| 11:05:45 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4095165633.0000000002BC4000.00000004.00000800.00020000.00000000.sdmp, M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 13:15:50 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/16 \| 00:54:06 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/06 \| 19:44:48 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/13 \| 20:21:31 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/27 \| 19:59:57 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 06:31:02 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/12 \| 16:10:13 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/08 \| 23:16:38 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 19:42:10 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4095165633.0000000002BC4000.00000004.00000800.00020000.00000000.sdmp, M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 13:00:28 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/19 \| 19:42:07 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/13 \| 07:43:14 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4095165633.0000000002BC4000.00000004.00000800.00020000.00000000.sdmp, M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 12:36:08 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 10:49:25 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/29 \| 23:57:24 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 11:57:29 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/25 \| 15:46:23 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/21 \| 22:59:19 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 14:00:57 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/13 \| 19:44:05 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/24 \| 02:25:39 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 11:09:57 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/29 \| 09:13:56 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/05/02 \| 04:10:22 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/19 \| 19:34:32 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/13 \| 18:36:01 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 18:36:57 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/13 \| 19:00:21 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/30 \| 00:20:15 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 05:12:37 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 18:02:32 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/05/02 \| 04:11:04 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/13 \| 18:46:47 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/26 \| 07:10:01 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 19:09:14 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/12 \| 15:56:39 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 07:06:36 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 14:24:36 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/16 \| 00:11:04 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/08 \| 23:52:00 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 00:50:15 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/21 \| 06:26:10 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 05:20:32 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 01:17:37 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 00:09:33 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/03 \| 23:10:03 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/19 \| 19:29:25 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/24 \| 02:58:43 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 19:35:08 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 00:50:26 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 00:00:20 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/17 \| 15:35:03 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/19 \| 19:35:14 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/16 \| 00:21:28 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 17:45:16 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/29 \| 08:27:41 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 18:27:04 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/25 \| 15:42:27 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/17 \| 15:26:15 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/21 \| 23:01:33 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/24 \| 03:28:45 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 10:46:48 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 01:32:14 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/24 \| 02:23:38 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/27 \| 20:04:11 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 07:03:05 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 00:20:14 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/26 \| 07:10:29 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/21 \| 23:02:04 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/13 \| 20:50:19 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/24 \| 03:14:40 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 00:49:30 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/04 \| 16:09:36 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/13 \| 18:34:00 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 19:19:10 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/30 \| 14:32:42 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/16 \| 00:32:17 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 14:39:32 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 11:04:40 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 19:24:02 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 10:54:32 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/24 \| 03:30:38 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/13 \| 20:02:58 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 08:22:05 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/30 \| 14:28:54 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/08 \| 23:20:37 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 17:38:23 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/15 \| 11:34:53 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 18:12:02 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/26 \| 06:58:28 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 11:24:56 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/08 \| 23:51:46 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/13 \| 20:28:49 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/09 \| 00:36:45 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/04 \| 16:12:59 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/13 \| 20:33:50 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/13 \| 19:49:42 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 15:13:11 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4095165633.0000000002BC4000.00000004.00000800.00020000.00000000.sdmp, M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 12:57:04 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 12:20:50 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 10:20:57 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/19 \| 19:31:01 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/29 \| 23:30:57 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4095165633.0000000002BC4000.00000004.00000800.00020000.00000000.sdmp, M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 12:42:45 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 13:52:33 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 18:12:19 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 08:24:39 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/28 \| 10:37:59 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/05/02 \| 04:13:53 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/24 \| 03:37:39 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/13 \| 19:48:01 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 18:39:34 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/15 \| 11:21:04 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4095165633.0000000002BC4000.00000004.00000800.00020000.00000000.sdmp, M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 13:26:02 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/03 \| 23:23:04 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/24 \| 03:01:50 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/16 \| 00:14:35 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 01:08:32 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 10:12:23 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/08 \| 23:06:51 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/12 \| 16:11:43 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/21 \| 23:04:38 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4095165633.0000000002BC4000.00000004.00000800.00020000.00000000.sdmp, M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 13:09:13 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/29 \| 23:40:27 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 07:18:07 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/24 \| 02:29:35 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/26 \| 23:14:39 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 00:40:08 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 00:29:27 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/19 \| 19:18:36 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 10:37:43 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/29 \| 23:55:12 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/26 \| 23:30:46 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 18:33:26 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/26 \| 23:15:04 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/24 \| 03:38:30 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/05/02 \| 04:20:46 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/13 \| 19:08:15 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/26 \| 23:40:42 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/26 \| 07:03:36 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/13 \| 07:36:32 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 17:51:05 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/28 \| 07:54:21 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 00:21:18 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/05/02 \| 04:03:57 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 06:29:26 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/24 \| 03:01:13 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/13 \| 18:58:55 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/21 \| 06:31:08 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 00:30:32 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 06:03:50 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/13 \| 20:46:51 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 10:03:09 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4095165633.00000000026C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\kqe
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/22 \| 14:11:52 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/17 \| 15:50:45 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/16 \| 00:23:12 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/16 \| 01:22:39 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/17 \| 15:23:10 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/08 \| 23:28:46 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/09 \| 00:16:51 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/16 \| 01:23:04 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/03 \| 22:58:02 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 10:01:45 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/29 \| 23:58:54 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/25 \| 16:00:36 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 10:27:58 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 07:11:54 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/30 \| 15:12:03 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/13 \| 20:03:29 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/09 \| 00:30:48 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 08:25:30 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/13 \| 07:38:33 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/17 \| 15:28:27 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/19 \| 19:42:18 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/16 \| 23:34:34 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/24 \| 03:03:14 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/14 \| 19:50:14 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/16 \| 00:38:47 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 05:29:34 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/28 \| 10:51:17 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/14 \| 19:40:29 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/16 \| 00:44:36 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 19:36:21 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/28 \| 11:54:04 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/29 \| 23:21:52 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 10:36:50 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/16 \| 00:15:00 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/05/02 \| 04:18:42 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/26 \| 23:17:16 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 14:51:32 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/28 \| 22:52:08 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/13 \| 19:49:05 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/13 \| 19:21:45 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/25 \| 16:04:54 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/03 \| 23:12:15 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/05/02 \| 04:41:05 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 06:37:38 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/12 \| 15:49:57 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 18:38:30 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 14:23:17 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 07:12:58 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 06:48:01 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/12 \| 16:05:54 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/30 \| 14:52:58 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 00:18:10 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/26 \| 23:27:01 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 06:04:54 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 00:44:26 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/03 \| 22:59:43 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 17:36:39 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 18:10:18 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/08 \| 23:29:39 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/08 \| 23:53:58 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 02:56:39 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 12:24:22 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/30 \| 14:30:58 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/29 \| 04:24:44 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/29 \| 23:48:36 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/06 \| 04:57:21 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 06:40:55 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 11:24:23 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/05/02 \| 03:58:49 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 12:09:45 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/26 \| 07:10:12 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/27 \| 19:54:03 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/29 \| 23:59:25 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 08:26:23 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 06:53:08 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 06:17:44 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/03 \| 23:54:09 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 18:51:08 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/16 \| 00:10:11 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/14 \| 20:04:03 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/09 \| 00:02:20 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/24 \| 03:02:21 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 05:09:40 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/14 \| 19:58:56 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/25 \| 15:43:40 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/25 \| 15:58:42 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/21 \| 22:58:26 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/15 \| 11:19:28 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/05/02 \| 04:30:16 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 08:42:14 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/22 \| 14:08:57 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 00:01:24 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/13 \| 18:47:18 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/17 \| 15:32:15 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 11:02:08 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/13 \| 19:29:39 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/05/02 \| 04:21:39 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/12 \| 16:08:59 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 06:01:01 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/21 \| 06:25:19 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/25 \| 15:52:45 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/08 \| 23:14:37 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/20 \| 10:34:18 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/04 \| 16:06:31 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/03 \| 23:59:50 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/14 \| 19:49:51 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/04 \| 00:13:21 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/02 \| 12:47:27 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/14 \| 20:08:16 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4095165633.0000000002BC4000.00000004.00000800.00020000.00000000.sdmp, M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 12:38:09 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 12:17:55 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/08 \| 23:51:09 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 18:23:56 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4095165633.0000000002BC4000.00000004.00000800.00020000.00000000.sdmp, M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/11 \| 12:40:33 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/24 \| 03:04:18 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 05:56:30 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/30 \| 15:05:38 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 18:32:33 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/18 \| 05:47:53 - Program Manager
Source: M5vARlA2c4.exe, 00000000.00000002.4097352961.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/02/24 \| 18:07:38 - Program Manager

Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Queries volume information: C:\Users\user\Desktop\M5vARlA2c4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Queries volume information: C:\Users\user\Desktop\M5vARlA2c4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Queries volume information: C:\Users\user\Desktop\M5vARlA2c4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Queries volume information: C:\Users\user\Desktop\M5vARlA2c4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\M5vARlA2c4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disables zone checking for all users

Source: C:\Users\user\Desktop\M5vARlA2c4.exe

Registry value created: HKEY_CURRENT_USER\Environment SEE_MASK_NOZONECHECKS

Jump to behavior

Source: M5vARlA2c4.exe, 00000000.00000002.4100814190.0000000005BD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s Defender\MsMpeng.exe
Source: M5vARlA2c4.exe, 00000000.00000002.4093489159.00000000007A1000.00000004.00000020.00020000.00000000.sdmp, M5vARlA2c4.exe, 00000000.00000002.4100814190.0000000005BD0000.00000004.00000020.00020000.00000000.sdmp, M5vARlA2c4.exe, 00000000.00000002.4100814190.0000000005BF0000.00000004.00000020.00020000.00000000.sdmp, M5vARlA2c4.exe, 00000000.00000002.4093489159.0000000000809000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: M5vARlA2c4.exe, 00000000.00000002.4100814190.0000000005BF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\M5vARlA2c4.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\M5vARlA2c4.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Njrat

Source: Yara match	File source: M5vARlA2c4.exe, type: SAMPLE
Source: Yara match	File source: 0.0.M5vARlA2c4.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1635018211.0000000000192000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4095165633.0000000002671000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: M5vARlA2c4.exe PID: 6720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: M5vARlA2c4.exe PID: 6340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: M5vARlA2c4.exe PID: 2996, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Java update.exe PID: 6168, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, type: DROPPED

Remote Access Functionality

Yara detected Njrat

Source: Yara match	File source: M5vARlA2c4.exe, type: SAMPLE
Source: Yara match	File source: 0.0.M5vARlA2c4.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1635018211.0000000000192000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4095165633.0000000002671000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: M5vARlA2c4.exe PID: 6720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: M5vARlA2c4.exe PID: 6340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: M5vARlA2c4.exe PID: 2996, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Java update.exe PID: 6168, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	121 Registry Run Keys / Startup Folder	2 Process Injection	1 Masquerading	OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	121 Registry Run Keys / Startup Folder	11 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
M5vARlA2c4.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
M5vARlA2c4.exe	85%	Virustotal		Browse
M5vARlA2c4.exe	100%	Avira	TR/Dropper.Gen7
M5vARlA2c4.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	100%	Avira	TR/Dropper.Gen7
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	85%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
6.tcp.eu.ngrok.io	12%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
6.tcp.eu.ngrok.io	3.68.171.119	true	true	12%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
52.28.247.255	unknown	United States		16509	AMAZON-02US	true
3.68.171.119	6.tcp.eu.ngrok.io	United States		16509	AMAZON-02US	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1390286
Start date and time:	2024-02-11 06:46:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	M5vARlA2c4.exe renamed because original name is a hash value
Original Sample Name:	022acabaf8af0e28844b01f4929ee95c.exe
Detection:	MAL
Classification:	mal100.phis.troj.adwa.evad.winEXE@5/4@2/2
EGA Information:	Successful, ratio: 20%
HCA Information:	Successful, ratio: 95% Number of executed functions: 127 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Java update.exe, PID 6168 because it is empty
Execution Graph export aborted for target M5vARlA2c4.exe, PID 2996 because it is empty
Execution Graph export aborted for target M5vARlA2c4.exe, PID 6340 because it is empty
Execution Graph export aborted for target M5vARlA2c4.exe, PID 6460 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:46:58	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Windows Update "C:\Users\user\Desktop\M5vARlA2c4.exe" ..
05:47:09	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Windows Update "C:\Users\user\Desktop\M5vARlA2c4.exe" ..
05:47:17	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Windows Update "C:\Users\user\Desktop\M5vARlA2c4.exe" ..
05:47:26	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe
06:47:01	API Interceptor	473922x Sleep call for process: M5vARlA2c4.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
52.28.247.255	1.exe	Get hash	malicious	Njrat	Browse
	rkIcS0Y2WY.exe	Get hash	malicious	Njrat	Browse
	N1aqZIb7KG.exe	Get hash	malicious	Njrat	Browse
	QsKtlzYaKF.exe	Get hash	malicious	Njrat	Browse
	dKe1GfZOs1.exe	Get hash	malicious	Njrat	Browse
	X5eo58PPCB.exe	Get hash	malicious	Njrat	Browse
	ZuXcnAYgVp.exe	Get hash	malicious	Njrat	Browse
	wiUnP1h5Ex.exe	Get hash	malicious	Njrat	Browse
	BqFosj9Wcb.exe	Get hash	malicious	Njrat	Browse
	d09l64ZAW6.exe	Get hash	malicious	Njrat	Browse
3.68.171.119	YTYyFVemXR.exe	Get hash	malicious	Njrat	Browse
	zyx3qItgQK.exe	Get hash	malicious	Njrat	Browse
	NfJ0jC2dPr.exe	Get hash	malicious	Njrat	Browse
	226dVJ2zRZ.exe	Get hash	malicious	Njrat	Browse
	N1aqZIb7KG.exe	Get hash	malicious	Njrat	Browse
	m5l9v13hIi.exe	Get hash	malicious	Njrat	Browse
	sCXwkZrcZ3.exe	Get hash	malicious	Njrat	Browse
	X5eo58PPCB.exe	Get hash	malicious	Njrat	Browse
	wiUnP1h5Ex.exe	Get hash	malicious	Njrat	Browse
	d09l64ZAW6.exe	Get hash	malicious	Njrat	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
6.tcp.eu.ngrok.io	YTYyFVemXR.exe	Get hash	malicious	Njrat	Browse	3.68.171.119
	zyx3qItgQK.exe	Get hash	malicious	Njrat	Browse	3.69.115.178
	NfJ0jC2dPr.exe	Get hash	malicious	Njrat	Browse	3.69.157.220
	ziTLBa3N50.exe	Get hash	malicious	Njrat	Browse	3.69.157.220
	1.exe	Get hash	malicious	Njrat	Browse	3.66.38.117
	226dVJ2zRZ.exe	Get hash	malicious	Njrat	Browse	3.69.157.220
	IsJb5hB84q.exe	Get hash	malicious	Njrat	Browse	3.66.38.117
	Terraria.exe	Get hash	malicious	Njrat	Browse	3.66.38.117
	myidJB8lDL.exe	Get hash	malicious	Njrat	Browse	3.69.115.178
	rkIcS0Y2WY.exe	Get hash	malicious	Njrat	Browse	3.69.115.178

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	108.142.224.137
	la.bot.arm.elf	Get hash	malicious	Mirai	Browse	52.60.177.86
	UKYj4rfNwY.elf	Get hash	malicious	Mirai	Browse	44.243.245.77
	x5YJAcb2Nh.elf	Get hash	malicious	Mirai	Browse	18.142.151.220
	d4dtHo2bNn.elf	Get hash	malicious	Mirai	Browse	13.120.66.131
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	13.218.158.41
	sora.arm.elf	Get hash	malicious	Mirai	Browse	18.245.17.48
	OXnFrFdLpC.elf	Get hash	malicious	Unknown	Browse	52.10.195.53
	fmoxN12Pdb.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	3.163.101.10
	xY3F1ZEqHz.elf	Get hash	malicious	Unknown	Browse	18.179.63.162
AMAZON-02US	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	108.142.224.137
	la.bot.arm.elf	Get hash	malicious	Mirai	Browse	52.60.177.86
	UKYj4rfNwY.elf	Get hash	malicious	Mirai	Browse	44.243.245.77
	x5YJAcb2Nh.elf	Get hash	malicious	Mirai	Browse	18.142.151.220
	d4dtHo2bNn.elf	Get hash	malicious	Mirai	Browse	13.120.66.131
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	13.218.158.41
	sora.arm.elf	Get hash	malicious	Mirai	Browse	18.245.17.48
	OXnFrFdLpC.elf	Get hash	malicious	Unknown	Browse	52.10.195.53
	fmoxN12Pdb.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	3.163.101.10
	xY3F1ZEqHz.elf	Get hash	malicious	Unknown	Browse	18.179.63.162

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	507
Entropy (8bit):	5.344008188221104
Encrypted:	false
SSDEEP:	12:Q3La/hz92n4M0kvoDLI4MWuCqDLI4MWuPTAq1KDLI4M6:MLU84jE4K5E4KH1qE4j
MD5:	285ADD706E818D58486213C030BD9ED5
SHA1:	3593842190DB067FC23F4E3E7A8FC69263800A47
SHA-256:	20B63D70AA9351A7ECC1E8B4A8099BC7D6A4500BA11DE6BCFB028D09475A6D7E
SHA-512:	935832497DF8AD8A4676947C0BCEC89C312753E604B3C2AAAAA42CDF2DFEDD5151385B44589C8E304ABA26D9578DFF1FE841EDE6EB5E784208984584FB8B2201
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\M5vARlA2c4.exe.log

Download File

Process:	C:\Users\user\Desktop\M5vARlA2c4.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	507
Entropy (8bit):	5.344008188221104
Encrypted:	false
SSDEEP:	12:Q3La/hz92n4M0kvoDLI4MWuCqDLI4MWuPTAq1KDLI4M6:MLU84jE4K5E4KH1qE4j
MD5:	285ADD706E818D58486213C030BD9ED5
SHA1:	3593842190DB067FC23F4E3E7A8FC69263800A47
SHA-256:	20B63D70AA9351A7ECC1E8B4A8099BC7D6A4500BA11DE6BCFB028D09475A6D7E
SHA-512:	935832497DF8AD8A4676947C0BCEC89C312753E604B3C2AAAAA42CDF2DFEDD5151385B44589C8E304ABA26D9578DFF1FE841EDE6EB5E784208984584FB8B2201
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe

Download File

Process:	C:\Users\user\Desktop\M5vARlA2c4.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	44032
Entropy (8bit):	5.606415957522971
Encrypted:	false
SSDEEP:	384:YZyq6NUst+3gUy6tZFIEEEoHjtJEzQIij+ZsNO3PlpJKkkjh/TzF7pWnI/greT0k:uqwQh6PFtkjGuXQ/oJ3+L
MD5:	022ACABAF8AF0E28844B01F4929EE95C
SHA1:	B0096D8C5D45CB7E9E0B3DF0B5BE5C92669530DC
SHA-256:	E76EA7B90A900ED00F982CEEFF3E6B1F08956F08F8E00DAF59C140F51D0DEB2C
SHA-512:	0F474F4F144FF33E6F46AA0C3EE8E29595429CE270C5921E46D537EBF20E06D80DF5BD5B0D08DF756740224D05B77822B50C4FB377744332E07FD5F2AF658B26
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, Author: JPCERT/CC Incident Response Group
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84% Antivirus: Virustotal, Detection: 85%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....V.e................................. ........@.. ....................... ............@.................................8...S.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................p.......H.......@y...I......T....x................................................(......(.....s.........s.........s.........s.........s..........0..........~....o......0..........~....o......0..........~....o......0..........~....o......0..........~....o......0................,.........o....9....~....,,~.........(....o...., r...p......(....s....zs.........~.........(.....o....(...+..lu....%-.&.+.%.(.....o...............&r;..p..........o....o......(.......o....s....z~........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\M5vARlA2c4.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.606415957522971
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	M5vARlA2c4.exe
File size:	44'032 bytes
MD5:	022acabaf8af0e28844b01f4929ee95c
SHA1:	b0096d8c5d45cb7e9e0b3df0b5be5c92669530dc
SHA256:	e76ea7b90a900ed00f982ceeff3e6b1f08956f08f8e00daf59c140f51d0deb2c
SHA512:	0f474f4f144ff33e6f46aa0c3ee8e29595429ce270c5921e46d537ebf20e06d80df5bd5b0d08df756740224d05b77822b50c4fb377744332e07fd5f2af658b26
SSDEEP:	384:YZyq6NUst+3gUy6tZFIEEEoHjtJEzQIij+ZsNO3PlpJKkkjh/TzF7pWnI/greT0k:uqwQh6PFtkjGuXQ/oJ3+L
TLSH:	1413E78CB694E174D5FF8BF1B4A2B2890B71A017A806930FD9F154D94BB3EC09611EE7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....V.e................................. ........@.. ....................... ............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x40c38e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x65C356D6 [Wed Feb 7 10:09:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc338	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe000	0x400	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x10000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa394	0xa400	b0c2d211bc417e0554ea5a36451ad356	False	0.4204458841463415	data	5.699451100649261	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xe000	0x400	0x400	e6bddab8cfc5a0b85c6b2404ef045c60	False	0.3017578125	data	3.5160679793070893	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x10000	0xc	0x200	7944e824d98cd140be139d8516798e9a	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0xe058	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.43.68.171.11949736169922815696 02/11/24-06:47:39.675578	TCP	2815696	ETPRO TROJAN Win32.FrauDrop.akljo Backdoor Beacon	49736	16992	192.168.2.4	3.68.171.119
192.168.2.43.68.171.11949736169922825563 02/11/24-06:47:39.874632	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49736	16992	192.168.2.4	3.68.171.119
192.168.2.43.68.171.11949729169922033132 02/11/24-06:47:01.754129	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49729	16992	192.168.2.4	3.68.171.119
192.168.2.43.68.171.11949736169922033132 02/11/24-06:47:39.675578	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49736	16992	192.168.2.4	3.68.171.119
192.168.2.43.68.171.11949729169922825564 02/11/24-06:47:33.737666	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49729	16992	192.168.2.4	3.68.171.119
192.168.2.43.68.171.11949736169922825564 02/11/24-06:50:02.578895	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49736	16992	192.168.2.4	3.68.171.119
192.168.2.43.68.171.11949729169922815696 02/11/24-06:47:01.754129	TCP	2815696	ETPRO TROJAN Win32.FrauDrop.akljo Backdoor Beacon	49729	16992	192.168.2.4	3.68.171.119
192.168.2.452.28.247.25549738169922033132 02/11/24-06:50:07.531136	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49738	16992	192.168.2.4	52.28.247.255
192.168.2.43.68.171.11949729169922825563 02/11/24-06:47:01.954776	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49729	16992	192.168.2.4	3.68.171.119
192.168.2.452.28.247.25549738169922815696 02/11/24-06:50:07.531136	TCP	2815696	ETPRO TROJAN Win32.FrauDrop.akljo Backdoor Beacon	49738	16992	192.168.2.4	52.28.247.255
192.168.2.452.28.247.25549738169922825564 02/11/24-06:50:56.577061	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49738	16992	192.168.2.4	52.28.247.255

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 11, 2024 06:47:01.356220007 CET	49729	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:47:01.556572914 CET	16992	49729	3.68.171.119	192.168.2.4
Feb 11, 2024 06:47:01.556829929 CET	49729	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:47:01.754128933 CET	49729	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:47:01.954521894 CET	16992	49729	3.68.171.119	192.168.2.4
Feb 11, 2024 06:47:01.954776049 CET	49729	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:47:02.154934883 CET	16992	49729	3.68.171.119	192.168.2.4
Feb 11, 2024 06:47:07.440104961 CET	49729	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:47:07.640312910 CET	16992	49729	3.68.171.119	192.168.2.4
Feb 11, 2024 06:47:22.876965046 CET	16992	49729	3.68.171.119	192.168.2.4
Feb 11, 2024 06:47:22.877058983 CET	49729	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:47:24.830270052 CET	49729	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:47:25.030524969 CET	16992	49729	3.68.171.119	192.168.2.4
Feb 11, 2024 06:47:33.737665892 CET	49729	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:47:33.938121080 CET	16992	49729	3.68.171.119	192.168.2.4
Feb 11, 2024 06:47:36.865010023 CET	16992	49729	3.68.171.119	192.168.2.4
Feb 11, 2024 06:47:36.865117073 CET	49729	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:47:38.876733065 CET	49729	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:47:38.878070116 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:47:39.076917887 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:47:39.076980114 CET	16992	49729	3.68.171.119	192.168.2.4
Feb 11, 2024 06:47:39.077002048 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:47:39.675578117 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:47:39.874562025 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:47:39.874631882 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:47:40.073396921 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:47:40.876786947 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:47:41.075956106 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:47:56.089287996 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:47:56.089716911 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:03.845710993 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:04.044666052 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:04.580116034 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:04.779310942 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:07.017410994 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:07.216896057 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:07.217206955 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:07.416955948 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:08.224066019 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:08.423544884 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:08.423618078 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:08.622868061 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:08.672813892 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:08.871957064 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:08.872025967 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:09.071255922 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:09.071568012 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:09.270837069 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:09.270925045 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:09.470030069 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:09.470140934 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:09.669445038 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:09.669615984 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:09.868956089 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:09.869406939 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:10.068929911 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:10.069021940 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:10.268382072 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:10.268739939 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:10.469238997 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:10.469475985 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:10.668673038 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:10.668817043 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:10.868069887 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:10.868163109 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:11.067199945 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:11.067423105 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:11.266478062 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:11.266601086 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:11.465687037 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:11.465760946 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:11.664706945 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:11.664870024 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:11.863881111 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:11.864033937 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:12.062982082 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:12.063262939 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:12.262572050 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:12.262852907 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:12.462001085 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:12.462120056 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:12.661015034 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:12.661108971 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:12.860049963 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:12.860172033 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:13.059519053 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:13.059626102 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:13.258708000 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:13.258773088 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:13.457653999 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:13.457921028 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:13.656769037 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:13.656863928 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:13.855635881 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:13.855709076 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:14.054691076 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:14.054795027 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:14.253699064 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:14.253822088 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:14.452883005 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:14.452960014 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:14.651926994 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:14.652030945 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:14.851124048 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:14.851202011 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:15.050312996 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:15.050383091 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:15.249404907 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:15.249536991 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:15.448400974 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:15.448486090 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:15.647387028 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:15.647480011 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:15.846364975 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:15.846452951 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:16.045655012 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:16.045773029 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:16.244795084 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:16.244868994 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:16.443767071 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:16.443924904 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:16.642782927 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:16.643138885 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:16.842154980 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:16.842236996 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:17.041162968 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:17.041250944 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:17.240081072 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:17.240164995 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:17.438873053 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:19.587196112 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:19.786097050 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:19.786170959 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:19.985219955 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:19.985332966 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:20.184092999 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:20.184159994 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:20.383043051 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:20.383244991 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:20.582026958 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:20.582099915 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:20.780944109 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:20.781025887 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:20.979873896 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:20.979924917 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:21.178586960 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:21.178653002 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:21.377388954 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:21.377464056 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:21.576349020 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:21.576420069 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:21.775223017 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:21.775516987 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:21.974266052 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:21.976038933 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:22.174865961 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:22.177753925 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:22.376810074 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:22.380148888 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:22.578942060 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:22.579032898 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:22.778090954 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:22.778170109 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:23.079514027 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:23.278310061 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:23.278605938 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:23.477520943 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:23.477634907 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:23.676992893 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:23.677062035 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:23.875679970 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:23.875869989 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:24.074598074 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:24.074826956 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:24.273586988 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:24.273663044 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:24.472405910 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:24.472588062 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:24.671295881 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:24.671376944 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:24.870157957 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:24.870320082 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:25.069278955 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:25.069464922 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:25.268265963 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:25.268471003 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:25.467190027 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:25.467262030 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:25.668708086 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:25.668888092 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:25.868096113 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:25.868299007 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:26.067331076 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:26.067506075 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:26.266288042 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:26.266480923 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:26.465169907 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:26.465265036 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:26.664000034 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:26.664064884 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:26.863010883 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:26.863125086 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:27.062782049 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:27.062899113 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:27.261770964 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:27.261853933 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:27.460563898 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:27.460645914 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:27.659533978 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:27.659682035 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:27.858603954 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:27.858668089 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:28.057657003 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:28.057806969 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:28.256746054 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:28.256855011 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:28.455725908 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:28.455912113 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:28.654740095 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:28.654966116 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:28.853988886 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:28.854167938 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:29.053137064 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:29.053282976 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:29.252346039 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:29.252661943 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:29.451679945 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:29.451994896 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:29.651223898 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:29.651432037 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:29.850369930 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:29.850565910 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:30.049297094 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:30.049376965 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:30.248255014 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:30.248318911 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:30.447174072 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:30.447474003 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:30.646251917 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:30.646333933 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:30.845216990 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:30.845415115 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:31.044522047 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:31.044909000 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:31.245650053 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:31.245728016 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:31.446908951 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:31.446974039 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:31.646070957 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:31.646284103 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:31.845271111 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:31.845510960 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:32.044346094 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:32.044477940 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:32.243735075 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:32.243815899 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:32.442739964 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:32.442981958 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:32.642093897 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:32.642168045 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:32.841192961 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:32.841444969 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:33.040764093 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:33.040988922 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:33.239970922 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:33.240045071 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:33.439326048 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:33.439444065 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:33.638870001 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:33.639101982 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:33.838193893 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:33.838264942 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:34.037266970 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:34.037482023 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:34.236354113 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:34.236478090 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:34.435430050 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:34.435496092 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:34.634509087 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:34.634613991 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:34.833657980 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:34.833844900 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:35.032747030 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:35.467092037 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:35.666299105 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:36.651052952 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:36.850334883 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:36.850522041 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:37.049550056 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:37.049771070 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:37.248785973 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:37.248977900 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:37.447952032 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:37.448132038 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:37.647258043 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:37.647427082 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:37.846666098 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:37.846859932 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:38.046011925 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:38.046080112 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:38.245012999 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:38.245089054 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:38.443913937 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:38.444009066 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:38.642878056 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:38.643126965 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:38.842354059 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:38.842580080 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:39.041929960 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:39.042191029 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:39.241379023 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:39.241504908 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:39.440779924 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:39.440967083 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:39.640017986 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:39.640182018 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:39.839425087 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:39.839512110 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:40.038573980 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:40.038666964 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:40.237663984 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:40.237818956 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:40.436903954 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:40.437004089 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:40.636192083 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:40.636413097 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:40.835344076 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:40.835572004 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:41.034497976 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:41.034740925 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:41.233925104 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:41.234052896 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:41.434009075 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:41.434139967 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:41.633096933 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:41.633199930 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:41.832273006 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:41.832380056 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:42.031234026 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:42.031347990 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:42.230247974 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:42.230344057 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:42.429301023 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:42.429416895 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:42.628312111 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:42.628407001 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:42.827327013 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:42.827419043 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:43.026294947 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:43.026387930 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:43.225424051 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:43.225577116 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:43.424478054 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:43.424631119 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:43.623630047 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:43.624217033 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:43.823105097 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:43.823339939 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:44.022306919 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:44.022988081 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:44.221806049 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:44.221905947 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:44.420815945 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:44.420886040 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:44.620044947 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:44.620146036 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:44.819205999 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:44.819586992 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:45.018446922 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:45.018521070 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:45.217375994 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:45.217477083 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:45.416264057 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:45.416353941 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:45.615314007 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:45.615420103 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:45.814189911 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:45.814284086 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:46.013326883 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:46.013411045 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:46.212321997 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:46.212423086 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:46.411473036 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:46.411569118 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:46.610542059 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:46.610658884 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:46.809506893 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:46.809650898 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:47.008390903 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:47.008491993 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:47.207406998 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:47.207513094 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:47.406320095 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:47.406620026 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:47.605514050 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:47.605601072 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:47.804419994 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:47.804557085 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:48.003309011 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:48.003509045 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:48.202558041 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:48.202661991 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:48.401544094 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:48.401702881 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:48.600532055 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:48.600616932 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:48.799431086 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:48.801464081 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:49.000286102 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:49.000437975 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:49.199423075 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:49.199599028 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:49.398504972 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:49.398616076 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:49.597451925 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:49.597616911 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:49.796406984 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:49.796519041 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:49.995369911 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:49.995533943 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:50.194331884 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:50.194705963 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:50.393419981 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:50.394078970 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:50.592967987 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:50.593893051 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:50.792665958 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:50.793174982 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:50.992007017 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:50.992178917 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:51.191080093 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:51.191164970 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:51.391694069 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:51.391784906 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:51.590689898 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:51.591029882 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:51.789866924 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:51.789963961 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:51.989012957 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:51.989094973 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:52.188235044 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:52.328387976 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:52.527391911 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:53.669172049 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:53.867948055 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:53.868056059 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:54.066885948 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:54.066983938 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:54.265986919 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:54.266196966 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:54.465086937 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:54.465192080 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:54.663960934 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:54.664026022 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:54.862869978 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:54.863209963 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:55.062057018 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:55.062217951 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:55.261111021 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:55.261198044 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:55.459958076 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:55.460069895 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:55.659121037 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:55.659285069 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:55.858165979 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:55.861329079 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:56.060156107 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:56.060214996 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:56.259126902 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:56.259371042 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:56.458177090 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:56.458265066 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:56.657118082 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:56.657347918 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:56.856259108 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:56.856360912 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:57.055901051 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:57.056056023 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:57.254909992 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:57.255759001 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:57.454543114 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:57.457689047 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:57.656379938 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:57.657866001 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:57.856694937 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:57.857932091 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:58.056749105 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:58.057395935 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:58.256196022 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:58.256373882 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:58.455262899 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:58.455326080 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:58.654218912 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:58.654347897 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:58.853152990 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:58.853444099 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:59.052484035 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:59.052571058 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:59.251583099 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:59.251879930 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:59.450927973 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:59.451153994 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:59.650326967 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:59.650515079 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:48:59.849535942 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:48:59.849611998 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:00.048693895 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:00.048881054 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:00.247996092 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:00.248178959 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:00.446983099 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:00.447047949 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:00.646044016 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:00.646276951 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:00.845235109 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:00.845413923 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:01.044642925 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:01.044735909 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:01.243777037 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:01.243876934 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:01.442810059 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:01.443089008 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:01.642374039 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:01.642469883 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:01.841811895 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:01.842034101 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:02.040879965 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:02.040971994 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:02.239712000 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:02.239903927 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:02.438823938 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:02.439009905 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:02.638221025 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:02.638529062 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:02.837553024 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:02.837814093 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:03.036936045 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:03.037003994 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:03.236063957 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:03.236275911 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:03.435168028 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:03.435339928 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:03.634265900 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:03.634576082 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:03.833482027 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:03.833787918 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:04.032727957 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:04.032883883 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:04.231777906 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:04.231925011 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:04.430900097 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:04.431066036 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:04.629945993 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:04.630072117 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:04.829121113 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:04.829332113 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:05.028347015 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:05.028439999 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:05.227416039 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:05.227510929 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:05.426582098 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:05.426788092 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:05.626077890 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:05.626363993 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:05.825269938 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:05.825351954 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:06.024398088 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:06.024589062 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:06.223412037 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:06.223565102 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:06.422370911 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:06.422461987 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:06.621386051 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:06.621551037 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:06.820452929 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:06.820671082 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:07.019706964 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:07.019773960 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:07.218825102 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:07.219028950 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:07.418025017 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:07.418231964 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:07.617276907 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:07.617351055 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:07.816297054 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:07.816643000 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:08.015467882 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:08.015816927 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:08.215044022 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:08.215214014 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:08.414436102 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:08.414633036 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:08.614031076 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:08.614176035 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:08.813350916 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:08.813426018 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:09.012501955 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:09.012619972 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:09.211678982 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:09.433489084 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:09.632509947 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:09.632582903 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:09.831482887 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:10.902467012 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:11.101428986 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:11.101677895 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:11.300791979 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:11.301079035 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:11.500056028 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:11.500227928 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:11.699254036 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:11.699362993 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:11.898205996 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:11.898300886 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:12.097145081 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:12.097271919 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:12.296406984 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:12.296624899 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:12.495734930 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:12.495820045 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:12.694557905 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:12.694816113 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:12.893807888 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:12.894012928 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:13.092955112 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:13.093202114 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:13.292248964 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:13.292409897 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:13.491264105 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:13.491336107 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:13.690418005 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:13.690653086 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:13.889759064 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:13.889919043 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:14.088826895 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:14.088968992 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:14.287970066 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:14.288038969 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:14.487060070 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:14.487237930 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:14.686359882 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:14.686450958 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:14.885715961 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:14.885977983 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:15.085140944 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:15.085268974 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:15.284378052 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:15.284537077 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:15.483671904 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:15.483793974 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:15.682841063 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:15.682955980 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:15.882064104 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:15.882205009 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:16.081348896 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:16.081557989 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:16.280541897 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:16.280730009 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:16.479810953 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:16.479995966 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:16.679151058 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:16.679239988 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:16.878099918 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:16.878340006 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:17.077471018 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:17.077740908 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:17.276638031 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:17.276736975 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:17.475672960 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:17.475792885 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:17.674727917 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:17.674828053 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:17.875085115 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:17.875202894 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:18.074395895 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:18.074666977 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:18.273776054 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:18.274025917 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:18.473257065 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:18.473440886 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:18.672660112 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:18.672789097 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:18.871941090 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:18.872060061 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:19.071141005 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:19.071237087 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:19.270488024 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:19.270777941 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:19.469985008 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:19.470132113 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:19.669086933 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:19.669177055 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:19.868340969 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:19.868455887 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:20.067588091 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:20.067842960 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:20.266778946 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:20.266860008 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:20.465615988 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:20.465801001 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:20.664643049 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:20.664894104 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:20.864068985 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:20.864142895 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:21.063347101 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:21.063476086 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:21.262393951 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:21.262502909 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:21.461317062 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:21.461405993 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:21.660116911 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:21.660375118 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:21.859185934 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:21.859483004 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:22.058286905 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:22.058377028 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:22.257329941 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:22.257392883 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:22.456137896 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:22.456209898 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:22.654948950 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:22.655025005 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:22.853776932 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:22.853836060 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:23.052680016 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:23.052920103 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:23.251944065 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:23.252126932 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:23.451101065 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:23.451466084 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:23.650583982 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:23.651786089 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:23.851244926 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:23.852689981 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:24.051726103 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:24.051847935 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:24.250786066 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:24.252099991 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:24.450989962 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:24.453727961 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:24.652724981 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:24.653022051 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:24.852076054 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:24.852154016 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:25.051053047 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:25.051290035 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:25.250159025 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:25.250247002 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:25.449104071 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:25.449184895 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:25.648086071 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:25.648224115 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:25.847188950 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:25.847280025 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:26.046294928 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:26.046390057 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:26.245338917 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:28.083578110 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:28.282978058 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:28.283189058 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:28.482280016 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:28.482633114 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:28.681706905 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:28.681773901 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:28.880829096 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:28.880954027 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:29.080295086 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:29.080553055 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:29.279444933 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:29.279577971 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:29.478578091 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:29.478832006 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:29.677817106 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:29.678081989 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:29.876951933 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:29.877132893 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:30.076047897 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:30.076145887 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:30.275357962 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:30.275758982 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:30.474740982 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:30.474822998 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:30.673855066 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:30.674139023 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:30.873378038 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:30.873466015 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:31.072539091 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:31.072654963 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:31.271792889 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:31.271954060 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:31.470992088 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:31.471190929 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:31.670295000 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:31.670360088 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:31.869255066 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:31.869503021 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:32.068460941 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:32.068558931 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:32.267445087 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:32.267523050 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:32.466315031 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:32.466379881 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:32.665189981 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:32.665380955 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:32.864191055 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:32.864262104 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:33.063246965 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:33.063558102 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:33.262402058 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:33.262517929 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:33.461401939 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:33.461491108 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:33.660518885 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:33.660712004 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:33.860414982 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:33.860594988 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:34.059573889 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:34.059715033 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:34.258879900 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:34.259059906 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:34.458035946 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:34.458267927 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:34.657149076 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:34.657241106 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:34.856036901 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:34.856136084 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:35.054984093 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:35.055277109 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:35.254240036 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:35.254313946 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:35.453227997 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:35.453418016 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:35.652426958 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:35.652669907 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:35.851521015 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:35.851783991 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:36.050864935 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:36.050996065 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:36.249819994 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:36.250015020 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:36.448934078 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:36.449119091 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:36.647952080 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:36.648264885 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:36.847320080 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:36.847515106 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:37.046638966 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:37.046912909 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:37.245951891 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:37.246157885 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:37.445152998 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:37.445430040 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:37.644609928 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:37.644884109 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:37.844062090 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:37.844440937 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:38.043459892 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:38.043793917 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:38.242995977 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:38.243302107 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:38.442255974 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:38.442482948 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:38.641562939 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:38.641865969 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:38.840959072 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:38.841108084 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:39.040143013 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:39.040431023 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:39.239443064 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:39.239619970 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:39.438582897 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:39.438705921 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:39.637640953 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:39.638082027 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:39.837249041 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:39.837366104 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:40.036736012 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:40.036935091 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:40.237529039 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:40.237612009 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:40.438553095 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:40.438640118 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:40.637696981 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:40.637902975 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:40.837335110 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:40.837721109 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:41.036806107 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:41.036879063 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:41.235951900 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:41.236052036 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:41.435313940 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:41.435547113 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:41.634798050 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:41.634875059 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:41.833803892 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:41.833998919 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:42.032931089 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:42.033025980 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:42.231966972 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:42.232038021 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:42.431022882 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:42.431154013 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:42.630193949 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:42.630280018 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:42.829396009 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:42.829543114 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:43.029088020 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:43.029233932 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:43.228790998 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:43.229027033 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:43.428271055 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:43.877068043 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:44.076175928 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:45.341370106 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:45.540376902 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:45.540447950 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:45.739547968 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:45.739908934 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:45.938954115 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:45.939028978 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:46.138022900 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:46.138232946 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:46.337080956 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:46.337169886 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:46.536115885 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:46.536192894 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:46.735313892 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:46.735469103 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:46.934453011 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:46.934700012 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:47.133663893 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:47.133740902 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:47.332752943 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:47.332902908 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:47.531944036 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:47.532329082 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:47.731359005 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:47.731430054 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:47.930306911 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:47.930500031 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:48.129296064 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:48.129365921 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:48.328284979 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:48.328360081 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:48.527370930 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:48.527534008 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:48.726466894 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:48.726707935 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:48.925529003 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:48.925775051 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:49.124695063 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:49.124816895 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:49.323757887 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:49.323859930 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:49.522804976 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:49.522883892 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:49.721828938 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:49.721965075 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:49.921134949 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:49.921293974 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:50.120146036 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:50.120342016 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:50.319202900 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:50.319505930 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:50.518668890 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:50.518912077 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:50.717982054 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:50.718115091 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:50.917248011 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:50.917596102 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:51.117099047 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:51.117175102 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:51.315988064 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:51.316070080 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:51.514890909 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:51.515177965 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:51.714198112 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:51.714299917 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:51.913392067 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:51.913602114 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:52.112905979 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:52.113158941 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:52.312319040 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:52.312402010 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:52.511817932 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:52.511967897 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:52.711286068 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:52.711556911 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:52.910862923 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:52.911010027 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:53.110436916 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:53.110641003 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:53.310653925 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:53.310962915 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:53.510385990 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:53.510492086 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:53.709702969 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:53.709918976 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:53.909277916 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:53.909461975 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:54.108639002 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:54.108752012 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:54.307771921 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:54.307961941 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:54.507050037 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:54.507441044 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:54.706656933 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:54.706988096 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:54.906229019 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:54.906352997 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:55.105262041 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:55.105356932 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:55.304164886 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:55.304353952 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:55.503216982 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:55.503314018 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:55.702198982 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:55.702276945 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:55.901351929 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:55.901456118 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:56.100629091 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:56.100733995 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:56.299835920 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:56.299926043 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:56.498851061 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:56.498941898 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:56.697988033 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:56.698141098 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:56.897423029 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:56.897532940 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:57.096472979 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:57.096585989 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:57.295516014 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:57.295641899 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:57.494534969 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:57.494610071 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:57.693622112 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:57.693851948 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:57.893008947 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:57.893105030 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:58.092147112 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:58.092230082 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:58.291275978 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:58.291376114 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:58.490636110 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:58.490844965 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:58.689982891 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:58.690066099 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:58.889204979 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:58.889337063 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:59.088486910 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:59.088682890 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:59.287772894 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:59.287847996 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:59.486619949 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:59.486913919 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:59.685817003 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:59.686121941 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:49:59.884936094 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:49:59.885030031 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:50:00.084011078 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:50:00.084115028 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:50:00.283154011 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:50:00.283247948 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:50:00.482440948 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:50:00.482623100 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:50:00.682133913 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:50:00.682240009 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:50:00.881345987 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:50:00.903740883 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:50:01.103291988 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:50:02.578895092 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:50:02.777952909 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:50:02.778075933 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:50:02.976897001 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:50:02.976994991 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:50:03.175790071 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:50:03.175882101 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:50:03.374654055 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:50:03.374732018 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:50:03.577020884 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:50:03.577126980 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:50:03.776218891 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:50:03.776336908 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:50:03.975442886 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:50:03.975549936 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:50:04.175187111 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:50:04.175297976 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:50:04.374433041 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:50:04.374526978 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:50:04.574295998 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:50:04.574418068 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:50:04.773430109 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:50:04.773509026 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:50:04.972440004 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:50:04.972573996 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:50:05.143338919 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:50:05.143490076 CET	49736	16992	192.168.2.4	3.68.171.119
Feb 11, 2024 06:50:05.171531916 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:50:05.342248917 CET	16992	49736	3.68.171.119	192.168.2.4
Feb 11, 2024 06:50:07.280173063 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:07.487283945 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:07.487473965 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:07.531136036 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:07.738277912 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:07.738358974 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:07.945194006 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:07.945271969 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:08.152173042 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:08.152339935 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:08.359319925 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:08.359477997 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:08.566694021 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:08.566939116 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:08.773958921 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:08.774039984 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:08.981157064 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:08.981312990 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:09.188110113 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:09.188266039 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:09.394999027 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:09.395087004 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:09.602077961 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:09.602307081 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:09.809264898 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:09.809528112 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:10.016794920 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:10.016902924 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:10.224164963 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:10.224451065 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:10.431490898 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:10.431705952 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:10.638801098 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:10.638948917 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:10.846316099 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:10.846705914 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:11.053845882 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:11.053962946 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:11.260902882 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:11.261033058 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:11.468089104 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:11.468203068 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:11.675175905 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:11.675290108 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:11.882102966 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:11.882234097 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:12.089327097 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:12.089461088 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:12.296534061 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:12.296742916 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:12.504182100 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:12.504288912 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:12.711308956 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:12.711491108 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:12.918561935 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:12.918667078 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:13.125829935 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:13.125941038 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:13.332818985 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:13.332886934 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:13.540045023 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:13.540242910 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:13.747361898 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:13.747476101 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:13.954632044 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:13.954917908 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:14.161995888 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:14.162246943 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:14.369545937 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:14.369638920 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:14.576632977 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:14.576754093 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:14.783854008 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:14.783968925 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:14.990914106 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:14.991060019 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:15.197910070 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:15.198074102 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:15.404927969 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:15.405211926 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:15.612085104 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:15.612195015 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:15.819027901 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:15.819134951 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:16.026573896 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:16.026654959 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:16.233514071 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:16.233639956 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:16.440505028 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:16.440716982 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:16.647468090 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:16.647691965 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:16.854368925 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:16.854449987 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:17.061168909 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:17.061233044 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:17.268090963 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:17.268292904 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:17.475308895 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:17.475425005 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:17.682559967 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:17.682656050 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:17.889575005 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:19.695789099 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:19.902638912 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:19.902904987 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:20.109684944 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:20.109810114 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:20.316723108 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:20.316906929 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:20.523644924 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:20.523730993 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:20.730777979 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:20.730870008 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:20.937649012 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:20.937851906 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:21.144629955 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:21.144746065 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:21.351524115 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:21.351604939 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:21.558373928 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:21.558620930 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:21.765454054 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:21.765674114 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:21.972486019 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:21.972619057 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:22.179457903 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:22.179589033 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:22.386338949 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:22.386604071 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:22.593489885 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:22.593568087 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:22.800621986 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:22.800719023 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:23.007438898 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:23.007755041 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:23.214657068 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:23.214828014 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:23.421614885 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:23.421730995 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:23.628554106 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:23.628693104 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:23.835886955 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:23.835988998 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:24.042785883 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:24.042996883 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:24.249815941 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:24.250020981 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:24.456929922 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:24.457067013 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:24.664169073 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:24.664429903 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:24.871381998 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:24.871455908 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:25.078368902 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:25.078707933 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:25.285815954 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:25.286086082 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:25.492964983 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:25.493046999 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:25.700299978 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:25.700431108 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:25.907360077 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:25.907474995 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:26.114703894 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:26.114806890 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:26.321834087 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:26.321932077 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:26.528810978 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:26.529071093 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:26.736232042 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:26.736318111 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:26.943193913 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:26.943315029 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:27.150224924 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:27.150487900 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:27.357382059 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:27.357451916 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:27.564428091 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:27.564543009 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:27.771398067 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:27.771769047 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:27.978876114 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:27.979031086 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:28.185880899 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:28.186014891 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:28.392889023 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:28.393076897 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:28.599956989 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:28.600033045 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:28.806900978 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:28.807041883 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:29.014027119 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:29.014389038 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:29.221472979 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:29.221553087 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:29.428667068 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:29.428844929 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:29.635730028 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:29.635927916 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:29.842847109 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:29.843034029 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:30.049997091 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:30.050239086 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:30.257059097 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:30.257189989 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:30.464118004 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:30.464220047 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:30.671180010 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:30.671356916 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:30.878375053 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:30.878494024 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:31.085685968 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:31.085836887 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:31.292761087 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:31.293061972 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:31.499836922 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:31.500112057 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:31.707258940 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:31.707592964 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:31.914815903 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:31.914928913 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:32.121737003 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:32.121838093 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:32.328964949 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:32.329121113 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:32.536218882 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:32.536478043 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:32.743251085 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:32.743341923 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:32.950952053 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:32.951054096 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:33.157944918 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:33.158056021 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:33.364803076 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:33.364911079 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:33.571708918 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:33.571785927 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:33.778650999 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:33.778973103 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:33.985872984 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:33.985960007 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:34.192864895 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:34.192969084 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:34.400584936 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:34.400955915 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:34.608161926 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:34.608287096 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:34.815284967 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:34.815686941 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:35.022620916 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:35.326179028 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:35.533025980 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:36.770117998 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:36.976861954 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:36.976938963 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:37.184983969 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:37.185173988 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:37.392040014 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:37.392307043 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:37.599268913 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:37.599477053 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:37.806587934 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:37.806788921 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:38.013967037 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:38.014091015 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:38.221261024 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:38.221358061 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:38.428494930 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:38.428610086 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:38.635457993 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:38.635529995 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:38.842669964 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:38.842891932 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:39.049958944 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:39.050077915 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:39.257158995 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:39.257231951 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:39.464186907 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:39.464477062 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:39.671511889 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:39.671724081 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:39.878882885 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:39.878962994 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:40.085793972 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:40.085931063 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:40.292876005 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:40.292990923 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:40.499975920 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:40.500051022 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:40.707251072 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:40.707395077 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:40.914483070 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:40.914563894 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:41.121500015 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:41.121566057 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:41.328372955 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:41.328511953 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:41.535377979 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:41.535530090 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:41.742275953 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:41.742336988 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:41.949129105 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:41.949372053 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:42.156142950 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:42.156307936 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:42.363260031 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:42.363334894 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:42.570120096 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:42.570245981 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:42.777303934 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:42.777430058 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:42.984266043 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:42.984379053 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:43.191303968 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:43.191431999 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:43.398242950 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:43.398583889 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:43.605468988 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:43.605566025 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:43.812334061 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:43.812505007 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:44.019355059 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:44.019457102 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:44.226353884 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:44.226557016 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:44.433574915 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:44.433835983 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:44.640966892 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:44.641112089 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:44.848000050 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:44.848114014 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:45.055044889 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:45.055145979 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:45.262264013 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:45.262449980 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:45.469561100 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:45.469739914 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:45.676721096 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:45.677119970 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:45.884181023 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:45.884277105 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:46.091469049 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:46.091612101 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:46.299320936 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:46.299495935 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:46.506371021 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:46.506599903 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:46.713490963 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:46.713653088 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:46.920665979 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:46.920934916 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:47.127758026 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:47.127985954 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:47.335072994 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:47.335170031 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:47.542244911 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:47.542330027 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:47.749371052 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:47.749495029 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:47.956517935 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:47.956607103 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:48.164474010 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:48.164556980 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:48.373625994 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:48.373791933 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:48.580852985 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:48.581052065 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:48.788132906 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:48.788218975 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:48.995066881 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:48.995201111 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:49.202414989 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:49.202543974 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:49.409486055 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:49.409619093 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:49.616651058 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:49.616758108 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:49.823740005 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:49.823875904 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:50.031048059 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:50.031362057 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:50.238627911 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:50.238708973 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:50.445658922 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:50.445756912 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:50.652798891 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:50.653119087 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:50.860337019 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:50.860635042 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:51.067718983 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:51.067806005 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:51.274705887 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:51.274971962 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:51.482045889 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:51.482115984 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:51.688854933 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:51.689055920 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:51.895848989 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:51.896054983 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:52.102869987 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:52.102941990 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:52.309998035 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:52.310066938 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:52.516838074 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:54.146159887 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:54.353313923 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:54.353416920 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:54.560168982 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:54.560359955 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:54.767210007 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:54.767282009 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:54.974059105 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:54.974252939 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:55.181265116 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:55.181349993 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:55.388407946 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:55.388547897 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:55.595530987 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:55.595643044 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:55.802623034 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:55.802726030 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:56.009763002 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:56.009835958 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:56.216809988 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:56.217000008 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:56.424072981 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:56.577060938 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:56.784410954 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:56.784672976 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:56.992218971 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:56.992535114 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:57.199625969 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:57.199786901 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:57.406793118 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:57.407031059 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:57.614329100 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:57.614489079 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:57.821341991 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:57.821460962 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:58.028439999 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:58.028721094 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:58.236064911 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:58.236152887 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:58.443061113 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:58.443136930 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:58.649926901 CET	16992	49738	52.28.247.255	192.168.2.4
Feb 11, 2024 06:50:58.650027990 CET	49738	16992	192.168.2.4	52.28.247.255
Feb 11, 2024 06:50:58.857048035 CET	16992	49738	52.28.247.255	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 11, 2024 06:47:01.233510971 CET	54247	53	192.168.2.4	1.1.1.1
Feb 11, 2024 06:47:01.353415966 CET	53	54247	1.1.1.1	192.168.2.4
Feb 11, 2024 06:50:07.159255028 CET	54506	53	192.168.2.4	1.1.1.1
Feb 11, 2024 06:50:07.279109001 CET	53	54506	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 11, 2024 06:47:01.233510971 CET	192.168.2.4	1.1.1.1	0xbd8a	Standard query (0)	6.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Feb 11, 2024 06:50:07.159255028 CET	192.168.2.4	1.1.1.1	0x1d7a	Standard query (0)	6.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 11, 2024 06:47:01.353415966 CET	1.1.1.1	192.168.2.4	0xbd8a	No error (0)	6.tcp.eu.ngrok.io		3.68.171.119	A (IP address)	IN (0x0001)	false
Feb 11, 2024 06:50:07.279109001 CET	1.1.1.1	192.168.2.4	0x1d7a	No error (0)	6.tcp.eu.ngrok.io		52.28.247.255	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	06:46:52
Start date:	11/02/2024
Path:	C:\Users\user\Desktop\M5vARlA2c4.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\M5vARlA2c4.exe
Imagebase:	0x190000
File size:	44'032 bytes
MD5 hash:	022ACABAF8AF0E28844B01F4929EE95C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000000.1635018211.0000000000192000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000000.1635018211.0000000000192000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: Njrat, Description: detect njRAT in memory, Source: 00000000.00000000.1635018211.0000000000192000.00000002.00000001.01000000.00000003.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000002.4095165633.0000000002671000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	06:47:07
Start date:	11/02/2024
Path:	C:\Users\user\Desktop\M5vARlA2c4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\M5vARlA2c4.exe" ..
Imagebase:	0x80000
File size:	44'032 bytes
MD5 hash:	022ACABAF8AF0E28844B01F4929EE95C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:47:17
Start date:	11/02/2024
Path:	C:\Users\user\Desktop\M5vARlA2c4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\M5vARlA2c4.exe" ..
Imagebase:	0xa80000
File size:	44'032 bytes
MD5 hash:	022ACABAF8AF0E28844B01F4929EE95C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:47:26
Start date:	11/02/2024
Path:	C:\Users\user\Desktop\M5vARlA2c4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\M5vARlA2c4.exe" ..
Imagebase:	0xd00000
File size:	44'032 bytes
MD5 hash:	022ACABAF8AF0E28844B01F4929EE95C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:47:34
Start date:	11/02/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe"
Imagebase:	0x4e0000
File size:	44'032 bytes
MD5 hash:	022ACABAF8AF0E28844B01F4929EE95C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, Author: JPCERT/CC Incident Response Group
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 84%, ReversingLabs Detection: 85%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.6%
Total number of Nodes:	183
Total number of Limit Nodes:	15

Executed Functions

Function 00C3D698 Relevance: 8.4, Strings: 6, Instructions: 890COMMON

Download Yara Rule

Strings

(okq, xrefs: 00C3DBC2
,oq, xrefs: 00C3DF80
Hoq, xrefs: 00C3DA8E
(okq, xrefs: 00C3DEFA
(okq, xrefs: 00C3DF08
,oq, xrefs: 00C3DF72

Memory Dump Source

Source File: 00000000.00000002.4094496693.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID: (okq$(okq$(okq$,oq$,oq$Hoq
API String ID: 0-2698134226
Opcode ID: dfc17f320303e72132fb37aca9a42828f771862a861946318e2cb45b250e8c38
Instruction ID: 6dfc6e4ab8dc2b4a280684e6a1ed7860214335d13de095ad0ab7cae15578c032
Opcode Fuzzy Hash: dfc17f320303e72132fb37aca9a42828f771862a861946318e2cb45b250e8c38
Instruction Fuzzy Hash: 78725270A102199FCB14DF69D984AAEBBF6FF88300F148569E416EB3A5DB34DD41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00C3A7D7 Relevance: 1.8, APIs: 1, Instructions: 266
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,?,00000000,00000000,?,?,?,00000000,00000000,?), ref: 00C3AA19

Memory Dump Source

Source File: 00000000.00000002.4094496693.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_M5vARlA2c4.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 8cf63569c4ab2a8c30af966d1ffafac39c07ff5c41287164186a1e98bed7abc2
Instruction ID: fa49f06bba90fd02319b225dc4a72365ea3d7b0c00af144603f87c36d7ea8bb4
Opcode Fuzzy Hash: 8cf63569c4ab2a8c30af966d1ffafac39c07ff5c41287164186a1e98bed7abc2
Instruction Fuzzy Hash: D7A15771D103499FDB15CFAAC8847DEBBF2AF88304F25812AE454A7290D7709996CF92

Uniqueness

Uniqueness Score: -1.00%

Function 00C3A828 Relevance: 1.7, APIs: 1, Instructions: 215
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,?,00000000,00000000,?,?,?,00000000,00000000,?), ref: 00C3AA19

Memory Dump Source

Source File: 00000000.00000002.4094496693.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_M5vARlA2c4.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 31626923342a834c255603a16b720c43593094f8ca97e1493032363a16824e25
Instruction ID: 3dde11a7071eb4afce0e94be8506ee0700d9fb594601856a3131195d02accc19
Opcode Fuzzy Hash: 31626923342a834c255603a16b720c43593094f8ca97e1493032363a16824e25
Instruction Fuzzy Hash: D091F471D10309DFDB14CFA9C94479EBBF2AF88304F25812AE458B7250D770A995CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04B52AE0 Relevance: 6.1, APIs: 4, Instructions: 137
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 04B52B6E
GetCurrentThread.KERNEL32 ref: 04B52BAB
GetCurrentProcess.KERNEL32 ref: 04B52BE8
GetCurrentThreadId.KERNEL32 ref: 04B52C41

Memory Dump Source

Source File: 00000000.00000002.4099917956.0000000004B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_M5vARlA2c4.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 357f1d8e9428457ca9b47ff12b0b8c68b7e5c3bfd103bace6980cff496ac6f23
Instruction ID: 2df80b00219605c85ebc97e2a94eb3f6f0dfdd3249ba467cbf8df00a538a5722
Opcode Fuzzy Hash: 357f1d8e9428457ca9b47ff12b0b8c68b7e5c3bfd103bace6980cff496ac6f23
Instruction Fuzzy Hash: E45164B09016098FDB18DFAAC548BDEBFF1EB48314F24C59AE408A7361D734A944CF66

Uniqueness

Uniqueness Score: -1.00%

Function 04B52AF0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 04B52B6E
GetCurrentThread.KERNEL32 ref: 04B52BAB
GetCurrentProcess.KERNEL32 ref: 04B52BE8
GetCurrentThreadId.KERNEL32 ref: 04B52C41

Memory Dump Source

Source File: 00000000.00000002.4099917956.0000000004B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_M5vARlA2c4.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 8ef21c815c2d426bc16a6515c1aca6a6217a2fbe4059762cf051b77dc3560eca
Instruction ID: 2c453fd824d077568e886c0c59fa740405d929ef1e2a7e8720b619f10f526859
Opcode Fuzzy Hash: 8ef21c815c2d426bc16a6515c1aca6a6217a2fbe4059762cf051b77dc3560eca
Instruction Fuzzy Hash: 6E5135B09016098FDB18DFAAD548BDEFBF1EB48314F24C499E409A7360D774A944CF69

Uniqueness

Uniqueness Score: -1.00%

Function 04B5A578 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4099917956.0000000004B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_M5vARlA2c4.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f4584d0a2009df966748b7c6904b972688ef2235616f7f8d4d4cd2bb62484c4e
Instruction ID: 17919ec7f116d6790ad6343794aaa97214b3ae95dd835cebe40f06411f1b0d47
Opcode Fuzzy Hash: f4584d0a2009df966748b7c6904b972688ef2235616f7f8d4d4cd2bb62484c4e
Instruction Fuzzy Hash: 10710370A00B058FDB24DF69D05475ABBF5FB88304F008A6ED88AA7A60DB75F845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04B5CB44 Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04B5CC62

Memory Dump Source

Source File: 00000000.00000002.4099917956.0000000004B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_M5vARlA2c4.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: fa50aba657ef4193aae98f22461e1faa47d6421b760fd0f4f84a6b11294be261
Instruction ID: da942c56c8fe42e3552455fe209699c758ffcea8af2f671e90df34edf1bb70b9
Opcode Fuzzy Hash: fa50aba657ef4193aae98f22461e1faa47d6421b760fd0f4f84a6b11294be261
Instruction Fuzzy Hash: 585190B1D003499FDB14CF99C984ADEBFB5FF48310F24816AE819AB221D775A985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04B5BF7C Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04B5CC62

Memory Dump Source

Source File: 00000000.00000002.4099917956.0000000004B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_M5vARlA2c4.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: dcf246158f984825bed0a3aa06e76ece3428556812e85a335f56d833ccf21a57
Instruction ID: fadfc0ed2fc33c8982effae6e737b1b6b2e5aadef68a458863bec6d84646b7c6
Opcode Fuzzy Hash: dcf246158f984825bed0a3aa06e76ece3428556812e85a335f56d833ccf21a57
Instruction Fuzzy Hash: 535190B1D003499FDB14CF99C984ADEBFB5FF48310F24816AE819AB220D775A845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04B5C0CC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04B5F1D1

Memory Dump Source

Source File: 00000000.00000002.4099917956.0000000004B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_M5vARlA2c4.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 7313a8a2122f4aa7e059918334bb2001c13bffeae5f8c2e25a7520f25e468b41
Instruction ID: 2e19ccdbc1f0fb24418210fa5a950fde38d5febb9413c9a25449b26cb82bc8aa
Opcode Fuzzy Hash: 7313a8a2122f4aa7e059918334bb2001c13bffeae5f8c2e25a7520f25e468b41
Instruction Fuzzy Hash: 804108B5900245DFDB14DF99C848BAAFBF5FB88314F24C499E919AB321D735A841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 04B52D30 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,04B52CFE,?,?,?,?,?), ref: 04B52DBF

Memory Dump Source

Source File: 00000000.00000002.4099917956.0000000004B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_M5vARlA2c4.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1fd78065106a8d1fb9531be43f33e68df888338f7bc929be4a36f748c7441118
Instruction ID: 661c56dc7b82ee71cec6d7cbff7672fb996d27c119f222c022b8f2cba525fada
Opcode Fuzzy Hash: 1fd78065106a8d1fb9531be43f33e68df888338f7bc929be4a36f748c7441118
Instruction Fuzzy Hash: F321E5B59002189FDB10CFAAD584ADEFFF4EB48320F14855AE918A7350D379A944CF65

Uniqueness

Uniqueness Score: -1.00%

Function 04B526CC Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,04B52CFE,?,?,?,?,?), ref: 04B52DBF

Memory Dump Source

Source File: 00000000.00000002.4099917956.0000000004B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_M5vARlA2c4.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c39ebb29b13e39300626a0f248131d7295796ca6dccd87d8bb29ebc8a613456c
Instruction ID: 764e92cde494f9434ce46eb9cd06f3f0d75f058c404f89ad5060ca93af903766
Opcode Fuzzy Hash: c39ebb29b13e39300626a0f248131d7295796ca6dccd87d8bb29ebc8a613456c
Instruction Fuzzy Hash: 5D2114B5901218DFDB10CFAAD584AEEFFF4EB48320F14845AE918A7360D374A940CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 04B59498 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,04B5A849,00000800,00000000,00000000), ref: 04B5AA3A

Memory Dump Source

Source File: 00000000.00000002.4099917956.0000000004B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_M5vARlA2c4.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d9fae241a6aa75deeaa276098a2ddac72449944c8ce371ee33d0feeee71c6fd3
Instruction ID: 120534c08c09c49b9616dded3f772fbc8b9dc17204ea38f8484cbc249fa25922
Opcode Fuzzy Hash: d9fae241a6aa75deeaa276098a2ddac72449944c8ce371ee33d0feeee71c6fd3
Instruction Fuzzy Hash: 9A1112B69002089FDB20CF9AC544BDEFBF4EB48310F10856AE919B7210C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04B5A9C9 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,04B5A849,00000800,00000000,00000000), ref: 04B5AA3A

Memory Dump Source

Source File: 00000000.00000002.4099917956.0000000004B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_M5vARlA2c4.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 08fdf3c6f951aadaae5f01720411896f5e753565dc7882acccab5561a5c281f0
Instruction ID: ffdd8a590881cd18e408edbe3609ac348e61365ce3b3a3e6e769915f639c6373
Opcode Fuzzy Hash: 08fdf3c6f951aadaae5f01720411896f5e753565dc7882acccab5561a5c281f0
Instruction Fuzzy Hash: 901114B6C002498FDB10CFAAD544BDEFBF4EB88310F14856AD859B7210C375A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 04B59454 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,04B5A594), ref: 04B5A7CE

Memory Dump Source

Source File: 00000000.00000002.4099917956.0000000004B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_M5vARlA2c4.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 31deb75873a641528e4616d000ba8f7ca08b0f088ac1ac503640b8da3a7c3634
Instruction ID: e716349c6c521794e97f29472b8f57b809526ede1f35b3cddb6aee563f2f1915
Opcode Fuzzy Hash: 31deb75873a641528e4616d000ba8f7ca08b0f088ac1ac503640b8da3a7c3634
Instruction Fuzzy Hash: DD11FDB69002498BDB10DF9AD444B9EFBF4EB88324F10856AD929B7220D379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BDD5E0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4094098011.0000000000BDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bdd000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 417f5ee516ca75f656402f6588eb29836a3762ab512033f68f91ad06cfb8a350
Instruction ID: a18b20d92f317ca1ca256228823526328ab4f7e34b1283016c3ec97c56659019
Opcode Fuzzy Hash: 417f5ee516ca75f656402f6588eb29836a3762ab512033f68f91ad06cfb8a350
Instruction Fuzzy Hash: 5F2100B1604240DFCB05DF54D9C0B26FFA5FB98314F24C6AAE9490B356D336D856CAE2

Uniqueness

Uniqueness Score: -1.00%

Function 00BED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4094197674.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bed000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95c1c8fe01435508362e276654f8e70cd4c00fc4764b774446ceb41f281d5224
Instruction ID: b7a09ac6b5dcb0f3567fbaa9a16fac67702bf0077cd66a8a86dbc9c0330cd85d
Opcode Fuzzy Hash: 95c1c8fe01435508362e276654f8e70cd4c00fc4764b774446ceb41f281d5224
Instruction Fuzzy Hash: 9D21F271604280DFCB14DF15D9D4B26BBA5FB84314F28C5ADD80A4B297C3BAD847CA61

Uniqueness

Uniqueness Score: -1.00%

Function 00BED006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4094197674.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bed000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6ccdebbb06e4b2bab58f9dad2a7c5fdb82631ab6f3d104d3b34998694fdad3e
Instruction ID: bf970bc0bc59c2620b5907c30b3c387694d7af79bbb3c5306e72521d5cf4a353
Opcode Fuzzy Hash: f6ccdebbb06e4b2bab58f9dad2a7c5fdb82631ab6f3d104d3b34998694fdad3e
Instruction Fuzzy Hash: A321A4755093C08FCB02CF20D594715BFB1EB45314F28C5EAD8498B297C33AD80ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00BDD5DB Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4094098011.0000000000BDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bdd000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 9e57c978508af89c01ea1204de4d98fa1bc8037751efd3c466fb9c1a7b8cc741
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 07119D76504280CFCB16CF50D9C4B16BFA1FB94314F24C6AAD9490A256C336D85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00C3E3E8 Relevance: 12.2, Strings: 9, Instructions: 908COMMON

Download Yara Rule

Strings

(okq, xrefs: 00C3E8F7
(okq, xrefs: 00C3E59A
(okq, xrefs: 00C3E416
(okq, xrefs: 00C3E4FD
,oq, xrefs: 00C3E878
(okq, xrefs: 00C3E9A9
,oq, xrefs: 00C3E888
(okq, xrefs: 00C3E4D1
(okq, xrefs: 00C3E8E7

Memory Dump Source

Source File: 00000000.00000002.4094496693.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID: (okq$(okq$(okq$(okq$(okq$(okq$(okq$,oq$,oq
API String ID: 0-2115511855
Opcode ID: 4cba3c9fd74206dc335f4b291c7e5625331c48502e2116666f5ebff41e8aaf93
Instruction ID: bd1b07fe59d9b497acfe90e8d8a5c00fbd34d3147b5df61230f2dc2a3c5ab5aa
Opcode Fuzzy Hash: 4cba3c9fd74206dc335f4b291c7e5625331c48502e2116666f5ebff41e8aaf93
Instruction Fuzzy Hash: 2D823930A10209DFCB14CFA9D584AAEBBF2FF88314F158569E416AB3A5D734ED81CB51

Uniqueness

Uniqueness Score: -1.00%

Function 04B5AC50 Relevance: .5, Instructions: 528COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4099917956.0000000004B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a935dbdfe43193af5d244cc3ab73e7c3f8ff356480ddba55b9f189036aaf17
Instruction ID: 659dfd07319674a59c5f216c6e147f12430e3f593ae61fea08b0790108e5eff3
Opcode Fuzzy Hash: 68a935dbdfe43193af5d244cc3ab73e7c3f8ff356480ddba55b9f189036aaf17
Instruction Fuzzy Hash: 45523CB8580746CFE720CF14E5882997BF1FB88324F54461AD5616B2E4E3BC698BCF64

Uniqueness

Uniqueness Score: -1.00%

Function 04B59340 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4099917956.0000000004B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 940d7507f0e8c9688b81557b2a2384dbe158926c31045272e259e95bceb3120a
Instruction ID: d5861b255c08c00f2dc1aa1c7dad173ba3b1bfe20f9979289f2d97705dc51b71
Opcode Fuzzy Hash: 940d7507f0e8c9688b81557b2a2384dbe158926c31045272e259e95bceb3120a
Instruction Fuzzy Hash: 14A17E72A00219CFCF05DFB5C88469EF7B2FF89304B1545AAE805AB275EB75E946CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00C35A63 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4094496693.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 124989efd99f9448302aa5c2eb759d87f451297bebd22af200ad3540332caf26
Instruction ID: 90ef62ba34a8d37521adf7343fddd3c57fc1f789273603fceae36642d437d545
Opcode Fuzzy Hash: 124989efd99f9448302aa5c2eb759d87f451297bebd22af200ad3540332caf26
Instruction Fuzzy Hash: B921D1069A8DE7D7FB0431AB88D13D74391877B1D8BC96B01C33C807EA6D4D408B8217

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: M5vARlA2c4.exePID: 6340, Parent PID: 2580COMMON

Executed Functions

Function 007148D1 Relevance: 1.7, Strings: 1, Instructions: 476COMMON

Download Yara Rule

Strings

doq, xrefs: 00714BD5

Memory Dump Source

Source File: 00000001.00000002.1855018762.0000000000710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID: doq
API String ID: 0-3318987180
Opcode ID: 289a7e81c0c4fc8876a71433a3cf074547580f7118f2830057d303d19254d7ab
Instruction ID: 1dae76fd753129bca795261725ae80b2ef0fba61bb1cf0d2fd30d2c3740a1766
Opcode Fuzzy Hash: 289a7e81c0c4fc8876a71433a3cf074547580f7118f2830057d303d19254d7ab
Instruction Fuzzy Hash: 02224B74A00619DFDB24EF24DD84BA97BB6FB48310F1085AAE509A73A4DB369DC1CF50

Uniqueness

Uniqueness Score: -1.00%

Function 007140F0 Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

Tekq, xrefs: 00714232

Memory Dump Source

Source File: 00000001.00000002.1855018762.0000000000710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: f48b6a4a6bc123407a2f0f59dace6f32cb4f0f0c66cdf1de70deaab845b8c191
Instruction ID: 6770d9dbd69a6da556ef6a013fe9f0dfd43621e1f6f89bcf7f4120b7c02b7e4d
Opcode Fuzzy Hash: f48b6a4a6bc123407a2f0f59dace6f32cb4f0f0c66cdf1de70deaab845b8c191
Instruction Fuzzy Hash: EF51DF7464154AEFCB05FF68E9C494ABBBAFB48304F005666D404C732DDB72AD49CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00714100 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

Tekq, xrefs: 00714232

Memory Dump Source

Source File: 00000001.00000002.1855018762.0000000000710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: 45697b901bb91e70dda8ad4aa07a66145436a42010a2214590e62b6dbe51eb89
Instruction ID: f118c882e738326296243bda04ba9a9b31bcae11bd2b502564b48218ac9a7ea4
Opcode Fuzzy Hash: 45697b901bb91e70dda8ad4aa07a66145436a42010a2214590e62b6dbe51eb89
Instruction Fuzzy Hash: 6851BD7464154AEFCB05FF68E9C095ABBBAFB48314F009A66D4048732DDB72AD49CB90

Uniqueness

Uniqueness Score: -1.00%

Function 007196D8 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

eb, xrefs: 007196EA

Memory Dump Source

Source File: 00000001.00000002.1855018762.0000000000710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID: eb
API String ID: 0-2084175972
Opcode ID: 82159b46a53a99a8a34279fff670c78c99004a5d123140e83c289819a38be6ed
Instruction ID: 0c83b0d34f03c0f57e061f7856381bec74bd0c910ba40f854643c25c7078e691
Opcode Fuzzy Hash: 82159b46a53a99a8a34279fff670c78c99004a5d123140e83c289819a38be6ed
Instruction Fuzzy Hash: 3DF02E313052410FE754ABBCA5240AD3BD2DFC432070148B8E906CB39CEE28EE8283A6

Uniqueness

Uniqueness Score: -1.00%

Function 00719265 Relevance: .5, Instructions: 527COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1855018762.0000000000710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d4963381e759d782a4dfd592883c9005e810c7dced437f04941eb276e086b0f
Instruction ID: 44cf01d6f658a7b8227aafa4c6c467002106beadd7a0f2fe8ce82ed368cd1ec6
Opcode Fuzzy Hash: 6d4963381e759d782a4dfd592883c9005e810c7dced437f04941eb276e086b0f
Instruction Fuzzy Hash: 67F0273164E3881FD717A7F448340ED7F60DA022147010CEBC481DB1D7E9289E4A8392

Uniqueness

Uniqueness Score: -1.00%

Function 00719299 Relevance: .5, Instructions: 507COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1855018762.0000000000710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 548c30190f336d35fe902e117f2be1037a8095b2f3264d02d0fdc247ed62eca7
Instruction ID: 080cda8cd6b323b506d92a6589ba558645a0d594ccb808138e8d6ba3f53a7bf1
Opcode Fuzzy Hash: 548c30190f336d35fe902e117f2be1037a8095b2f3264d02d0fdc247ed62eca7
Instruction Fuzzy Hash: 9CE09B715493885FD7169BB488650EE7FA0DF062103050CEBD485DB2E6D9289A464392

Uniqueness

Uniqueness Score: -1.00%

Function 00718778 Relevance: .5, Instructions: 505COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1855018762.0000000000710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c6251b3349df5de225b07cf20218903ca1ac4bf2ebbe09c36f70452e7bcfc77
Instruction ID: cbd4c69a413ab6a105296c9dd259642040b9e35559a21700ce8f939175de21a2
Opcode Fuzzy Hash: 3c6251b3349df5de225b07cf20218903ca1ac4bf2ebbe09c36f70452e7bcfc77
Instruction Fuzzy Hash: 02025C7AA50100DFC7B1F715EED3BAA772AE764710F504A12E0005B3EDDB7AAC848E95

Uniqueness

Uniqueness Score: -1.00%

Function 007197C8 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1855018762.0000000000710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a87cad8ddc203d2aa63d00efa5ffc7c3e550ab7247e407cbb94bd8ce84fc2604
Instruction ID: 489780d17f62fa67806e98ba032a5e8dd8888960e704004a4b6cecd72d3ab3df
Opcode Fuzzy Hash: a87cad8ddc203d2aa63d00efa5ffc7c3e550ab7247e407cbb94bd8ce84fc2604
Instruction Fuzzy Hash: A04102717082508FD7059B7CA8A44AA7BF5EF8736071504EAD605CB3E6CA39EC46CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00713E00 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1855018762.0000000000710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7b93e1900b51dac6df6b08e133c4f33c6c7104a26f4e443b6a4a60594f299a4
Instruction ID: 25a0fcaac4cee7d261b31f5a4515faf7349aa4ed4a5e5ef8b86938486f826d2f
Opcode Fuzzy Hash: f7b93e1900b51dac6df6b08e133c4f33c6c7104a26f4e443b6a4a60594f299a4
Instruction Fuzzy Hash: CF319330B00215DFDB15BB78D9557BF7BAEAB88700F004469A105E73A8DF399D868BD0

Uniqueness

Uniqueness Score: -1.00%

Function 00710890 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1855018762.0000000000710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeb6afe092db4874bc0b1130297c6045e8e7b4c87f1c49ef6b99a49bb12273e8
Instruction ID: 90be51aa3cc73eb0c3c8b3f97fe792783bec00e64e2c69da7138201576e5bc3d
Opcode Fuzzy Hash: eeb6afe092db4874bc0b1130297c6045e8e7b4c87f1c49ef6b99a49bb12273e8
Instruction Fuzzy Hash: 87317CB1904348DFDB14DFA9D8457DEBFF5EF49320F10846AE114A72A1D779A480CB90

Uniqueness

Uniqueness Score: -1.00%

Function 007197B9 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1855018762.0000000000710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70ced9a44b90deb98b018f9927e250477efadb0b7c66770ce6bce548fb8cc922
Instruction ID: cfd6a1f989d85aa4a058af6c4fd8487fe4fdf585a660b2aafb312a7e2ce77e09
Opcode Fuzzy Hash: 70ced9a44b90deb98b018f9927e250477efadb0b7c66770ce6bce548fb8cc922
Instruction Fuzzy Hash: C321D7313002104FD714AF69E8A49AABBA6FF853217144579D116CB3E6DF34ED86C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00710994 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1855018762.0000000000710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e31ad19793a67bbf7dc8d2305a1ebf4356f57cbafc81d26be1a6dbd8085b488
Instruction ID: e51c68153bfca83b7b00328eca364cba547154a8845659db55aa68ce7a3dea08
Opcode Fuzzy Hash: 0e31ad19793a67bbf7dc8d2305a1ebf4356f57cbafc81d26be1a6dbd8085b488
Instruction Fuzzy Hash: 5A31E4B0D01248DFCB24CFA9D584BDDBFF5AF48310F24806AE405AB2A5C7B56985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00719729 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1855018762.0000000000710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2a946323cfd4d99d77b1c3b84bf3da563fc205ad2cd7b6a8ff7671b1da2a228
Instruction ID: 1010696d263cac41d120d32ecfa3c0567b7027f7b6ac30a77895a0a3ea38143c
Opcode Fuzzy Hash: f2a946323cfd4d99d77b1c3b84bf3da563fc205ad2cd7b6a8ff7671b1da2a228
Instruction Fuzzy Hash: 9421F3312442441FD715AB7899615EF7BA2EF85310B1449BDD046CB3EAEE28DE8B83D1

Uniqueness

Uniqueness Score: -1.00%

Function 007109A0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1855018762.0000000000710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34519cec95321221f1c2119ecd875ddd032baf4f56b6de1c0650cc7174df0f6c
Instruction ID: ad95f7476bce5def8dc99f13de37e6c4cd661296efb3877e4e55fb01b5bdff92
Opcode Fuzzy Hash: 34519cec95321221f1c2119ecd875ddd032baf4f56b6de1c0650cc7174df0f6c
Instruction Fuzzy Hash: BE31E2B0D01248DFCB14CF99D584BDDBFF5AF48310F24802AE408AB2A4CBB5A985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00718F80 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1855018762.0000000000710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86281b27ad29d9f65ba733aa2e703b974ceda565614e7558e41a932ca126b8a4
Instruction ID: 787fb58103b640b8b8fd8c976222f33d9c93321faff42b237726e5bc0d58bfb5
Opcode Fuzzy Hash: 86281b27ad29d9f65ba733aa2e703b974ceda565614e7558e41a932ca126b8a4
Instruction Fuzzy Hash: 90218DB6D00208CFCB60DF99D985BDEBFF9EB48320F10842AD418A7264D775A984CF95

Uniqueness

Uniqueness Score: -1.00%

Function 007196A0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1855018762.0000000000710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23cb4015a0f738f8ad272f31197e7a655307ae4188f049e9fa15dd3a6cdce8fe
Instruction ID: c4b8d206af5fd8be5cb724be4ce994a2771f11657a878a8c96f16532d4ca95e7
Opcode Fuzzy Hash: 23cb4015a0f738f8ad272f31197e7a655307ae4188f049e9fa15dd3a6cdce8fe
Instruction Fuzzy Hash: 58018631A4E3845FD7165BB468280EE7FA5DB4612070508FBD485CB2E3D93D9D468791

Uniqueness

Uniqueness Score: -1.00%

Function 00713CF8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1855018762.0000000000710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1f8629bf8212e789895d1e117aa867fb7f44e6d162fe5a9921ef008f3b82caa
Instruction ID: e43d424870d015a209352375ccb915e15d23a6e0f2838f00424e4bdf66f1e694
Opcode Fuzzy Hash: d1f8629bf8212e789895d1e117aa867fb7f44e6d162fe5a9921ef008f3b82caa
Instruction Fuzzy Hash: 4011007490010ADFCB01FFA8EC555ADBBB6EF88311F004569D106A73A5DF31AE898FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0071473C Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1855018762.0000000000710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cf73829395d97d313a6ec64963a27e891f94f200d3ab057d84a6f3c85edcce7
Instruction ID: 55c8c037dbd82b98a87fbe62d15a2a6c4f4f95750ecdf117a92a4010b1fe954f
Opcode Fuzzy Hash: 9cf73829395d97d313a6ec64963a27e891f94f200d3ab057d84a6f3c85edcce7
Instruction Fuzzy Hash: 7C1113B5900248CFCB60DF99D444BDEBFF5FB48320F20842AE559A7250C779A984CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00710DE0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1855018762.0000000000710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2945ffd866e8a5751b6147688a6108bc6990747e0ca5210c610c82e2ad2b28db
Instruction ID: e39c686553ae25af753a02e0536589f0df049b79a45131b710bb6b223552bbb7
Opcode Fuzzy Hash: 2945ffd866e8a5751b6147688a6108bc6990747e0ca5210c610c82e2ad2b28db
Instruction Fuzzy Hash: 05115EB12006408BC321EB79D54569A7BEBEB81320B14497DC0164B7A8DF76ED898FD5

Uniqueness

Uniqueness Score: -1.00%

Function 00719021 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1855018762.0000000000710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 267e401ed8fb9980f31ef00a765ca79d495bab903f7ed40ee63251ddd43e8696
Instruction ID: 41948459331e49caa0528ea617e5b383a29bcb9beabfbf3916d5c2913be97e3d
Opcode Fuzzy Hash: 267e401ed8fb9980f31ef00a765ca79d495bab903f7ed40ee63251ddd43e8696
Instruction Fuzzy Hash: 5F01B130B082558FCB05EB3CD55465DBBE0AF8A310F01456DD5C5CB3A1DB34DD428782

Uniqueness

Uniqueness Score: -1.00%

Function 007108F8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1855018762.0000000000710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7c116f493e7f35f002e28d39dfa296c1625b486f6ae5175f1a14505a1ee492d
Instruction ID: d0292e9b5ece1afe5be8f4d3e5c5b7d863c79885d898e15b266eafe3bebd6230
Opcode Fuzzy Hash: f7c116f493e7f35f002e28d39dfa296c1625b486f6ae5175f1a14505a1ee492d
Instruction Fuzzy Hash: F71125B59003498FDB20DFA9C484BDEBFF0EB48320F20845AD459A7351C375A984CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00710900 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1855018762.0000000000710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 545e14590ff557ae462bad4570d63481d33b6ce84d2799f4bd506a4dc9178e18
Instruction ID: bbb6668509466016224a2cc1d5a639d68473f3a79d032995d9721aa9f9e2f857
Opcode Fuzzy Hash: 545e14590ff557ae462bad4570d63481d33b6ce84d2799f4bd506a4dc9178e18
Instruction Fuzzy Hash: A31103B59002498FDB20DF9AC484BDEBBF4EB48324F20845AD459A7251C379A984CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00710EA0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1855018762.0000000000710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f091457f9677dfc3e97ff2f7d0f3f44da1ff446eb0e463c1c5af96a23b0ab79f
Instruction ID: 5c0818ea9ec5d3eac71577a8e7b1d41ed26925a9b122813462c1db01d4c58939
Opcode Fuzzy Hash: f091457f9677dfc3e97ff2f7d0f3f44da1ff446eb0e463c1c5af96a23b0ab79f
Instruction Fuzzy Hash: 18F02775204210CFC3115B7DA8510953BB6E98175131445BAC005CA2A8DB69D8C7C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 00719670 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1855018762.0000000000710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e53e1be466a20dd65f3d096d15dd15f2e8d2cc622e94a763d3389966edc4d4c
Instruction ID: ef740e637c105ff43784fda40416ac128fb78a736f3b907265e4618e45058958
Opcode Fuzzy Hash: 9e53e1be466a20dd65f3d096d15dd15f2e8d2cc622e94a763d3389966edc4d4c
Instruction Fuzzy Hash: B5D0A73160130C5FCB14EFF4451806E7AD9DB441107004DA9D406C7244ED31EF8046A2

Uniqueness

Uniqueness Score: -1.00%

Function 007196B0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1855018762.0000000000710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9ae2884e4a491d428f26820e409fef029cfda09d38a7f6affb80b55c8c2f3b0
Instruction ID: 5781ba907f20bfa70e286e0c410da8627803c9055dd68d15ca94a5ab0fc211f0
Opcode Fuzzy Hash: a9ae2884e4a491d428f26820e409fef029cfda09d38a7f6affb80b55c8c2f3b0
Instruction Fuzzy Hash: 73D0C9316053148F8B152AB4A41C059BAA9DB8957230044BAE80AC2340DEBAEC818790

Uniqueness

Uniqueness Score: -1.00%

Function 00710848 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1855018762.0000000000710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1757140c798f732eb2a61612aa175be8e7545d3734e627b0f197c6b278274a10
Instruction ID: 8d8c38b56fc731786eead25b44945bd69100311a796a8e759b2b5ef7ae3be0e2
Opcode Fuzzy Hash: 1757140c798f732eb2a61612aa175be8e7545d3734e627b0f197c6b278274a10
Instruction Fuzzy Hash: 61D0A970000A89CECB22FB28FCC57427F9EF300308F002262D0080B33ACBB2A40A8BC0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: M5vARlA2c4.exePID: 2996, Parent PID: 2580COMMON

Executed Functions

Function 013381A1 Relevance: 1.7, Strings: 1, Instructions: 458COMMON

Download Yara Rule

Strings

doq, xrefs: 01338485

Memory Dump Source

Source File: 00000003.00000002.1943645778.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1330000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID: doq
API String ID: 0-3318987180
Opcode ID: dc02c00ed963e578517e023314448957976b54603fcbd73da56a5a0b5adb120b
Instruction ID: ee7dcfb4e646cfff12dddcd11afc5d97d43c6e5e9410f456de5cba70034d6343
Opcode Fuzzy Hash: dc02c00ed963e578517e023314448957976b54603fcbd73da56a5a0b5adb120b
Instruction Fuzzy Hash: FF225F74A00219CFDB29EF78D954BAD77B2FB88308F1045A9E519A73A9DB319D81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 013376A8 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

Tekq, xrefs: 013377EA

Memory Dump Source

Source File: 00000003.00000002.1943645778.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1330000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: 508650cedaac2c04fdfb642fb986db2c82484182a4fa37629520c2f8320351c7
Instruction ID: fef1261ea6ea5dd53c816db70a62399e23e3b0d92af29bd25112de46e03637fb
Opcode Fuzzy Hash: 508650cedaac2c04fdfb642fb986db2c82484182a4fa37629520c2f8320351c7
Instruction Fuzzy Hash: 2C51E17464124ACFCB05FFADEAA496ABBB2FB443087009565D0058737EEB71A949CF80

Uniqueness

Uniqueness Score: -1.00%

Function 013376B8 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

Tekq, xrefs: 013377EA

Memory Dump Source

Source File: 00000003.00000002.1943645778.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1330000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: 259438e48f9e1a315d0e60130a4d117df7094ac58f2942240518d7c819736ff7
Instruction ID: 5b61866c6bef7fd37ab43d4997e370e99d628e7fed271a1fb8e03be3b3ca46cc
Opcode Fuzzy Hash: 259438e48f9e1a315d0e60130a4d117df7094ac58f2942240518d7c819736ff7
Instruction Fuzzy Hash: 7D51CD7564024ACFCB05FFADEAA496ABBB2FB443087009565D0058737EEB71A949CF80

Uniqueness

Uniqueness Score: -1.00%

Function 01330DCF Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

4'kq, xrefs: 01330DA8

Memory Dump Source

Source File: 00000003.00000002.1943645778.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1330000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: 65e3425e75b5fcc7a40c181df45a11ebb21521269a4f2aea0bee60388dcf514f
Instruction ID: 2c9e7955dcfcf869be331d3b95e2bff69aac6dde71509bb584cf40d639ec82c3
Opcode Fuzzy Hash: 65e3425e75b5fcc7a40c181df45a11ebb21521269a4f2aea0bee60388dcf514f
Instruction Fuzzy Hash: 953150706003498FC756EF78E91099EBBA2BF81308B104A7AC0559B768DB75ED89CB85

Uniqueness

Uniqueness Score: -1.00%

Function 013392B9 Relevance: .5, Instructions: 507COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1943645778.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1330000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c86d332493e1a1d4761792cdade39dcc52c90012387a38d84da3f4daf204401d
Instruction ID: fd4e952a05ea2ac32d8aa3c52d1ff492f176ad0707e0190c437e635e9ae967bd
Opcode Fuzzy Hash: c86d332493e1a1d4761792cdade39dcc52c90012387a38d84da3f4daf204401d
Instruction Fuzzy Hash: E8E092316093899FC7129FB8C82056DBFB4EF0B2047054DD6D081CB2A2DE349E508762

Uniqueness

Uniqueness Score: -1.00%

Function 01339285 Relevance: .5, Instructions: 497COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1943645778.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1330000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83224563113061a3d2747485926ee7a4c998c3f87f478a8b8521cd3fdefa65e0
Instruction ID: e898a71759479532d0fb1b89b0433d60fcb1d5888231ec9fc0480564cbb6bb46
Opcode Fuzzy Hash: 83224563113061a3d2747485926ee7a4c998c3f87f478a8b8521cd3fdefa65e0
Instruction Fuzzy Hash: 8C014731B093458FD746ABFC952029DBB65EF8A308B0189E6C841CF34ADF30CD458396

Uniqueness

Uniqueness Score: -1.00%

Function 01333DF0 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1943645778.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1330000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd97b643801a706fdd17137360aad2394c5fe2e9b9ca24872e794aa8d7e34a3e
Instruction ID: dadad0386ea07e2b007085f6b13439d4649f2c9c179463770bbfda3069cfb93d
Opcode Fuzzy Hash: cd97b643801a706fdd17137360aad2394c5fe2e9b9ca24872e794aa8d7e34a3e
Instruction Fuzzy Hash: D041B130B002099FDB1AAB78D92476E7BBABB84304F004479E545D73A9DB358C85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01333E00 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1943645778.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1330000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68b5f996e7415e64c07de95f5d210b8190a79c974b574ae49e08161f4b17eca9
Instruction ID: c476f73c046f0a4a11414c9c7fe4b459c9602c298dd23d055c81099eefe69344
Opcode Fuzzy Hash: 68b5f996e7415e64c07de95f5d210b8190a79c974b574ae49e08161f4b17eca9
Instruction Fuzzy Hash: BA318C30B00219DFDB19BB78D92476F7BAABB84704F108479E545D73A8DF359C858BA0

Uniqueness

Uniqueness Score: -1.00%

Function 01330890 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1943645778.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1330000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77681a0159dd0d43fa5fa71d39ffa35e721cd50fd09836a5dd232cb01daf9ea0
Instruction ID: e4d406fcd6a1a3cfaac9ab2f27bb87208fb15f2f9e9676d32ca538139ec805ac
Opcode Fuzzy Hash: 77681a0159dd0d43fa5fa71d39ffa35e721cd50fd09836a5dd232cb01daf9ea0
Instruction Fuzzy Hash: E4319AB19003089FDB18DFB9C8457AEBFF5EF88324F208869E515E7260D735A940CB94

Uniqueness

Uniqueness Score: -1.00%

Function 013397E8 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1943645778.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1330000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc3926b6ae0c16a35f853280b58c1ecc9f84f3e4073a02cf0b47006b865f0a35
Instruction ID: 5ca81d09894dc45d902f0d25a538a5166b428865b25e6bee972ca9805142fd02
Opcode Fuzzy Hash: dc3926b6ae0c16a35f853280b58c1ecc9f84f3e4073a02cf0b47006b865f0a35
Instruction Fuzzy Hash: B721EC31708344CFD7199B7CE9A4A2ABFB9FBC630871104AAD515CB395CB21DC04CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 01330994 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1943645778.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1330000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baa65ca83902387b21383ddad2effc3a4f9da8167ceaef1c84d5fe7ac82f7913
Instruction ID: 2739f4950a3fbdfbe57c0e1907f9f26362f3538f7825f7601fedecccf8768388
Opcode Fuzzy Hash: baa65ca83902387b21383ddad2effc3a4f9da8167ceaef1c84d5fe7ac82f7913
Instruction Fuzzy Hash: E431F1B0D01248DFDB14CFA9D584BDDBFF5AF88314F20816AE408AB264C7759946CB95

Uniqueness

Uniqueness Score: -1.00%

Function 013309A0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1943645778.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1330000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85d4284d1c0716fa98d1a058860c4387739fda369d944f4425b709d92b970c8c
Instruction ID: a16e2b6bd34d6cd9d09a1765fe668754ecc1249edc34a1fe3500f954f75513a7
Opcode Fuzzy Hash: 85d4284d1c0716fa98d1a058860c4387739fda369d944f4425b709d92b970c8c
Instruction Fuzzy Hash: E831F0B0D01248DFDB14CFA9D584BDDBFF5AF88314F20802AE408AB264CB74A946CB95

Uniqueness

Uniqueness Score: -1.00%

Function 01333CE9 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1943645778.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1330000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91fc8ef9fc71dd400a8e4960c40dfd6cecaa6d4f4819d989247a14d85ac51f4d
Instruction ID: df5473cd406c733f6cefc076113f014df0f83878a91f76d694161f46fe56d144
Opcode Fuzzy Hash: 91fc8ef9fc71dd400a8e4960c40dfd6cecaa6d4f4819d989247a14d85ac51f4d
Instruction Fuzzy Hash: C5215B3494030EDFCB09EFA8E9545ADBBB5FF85304B004569D525A73A4DB31AA88CB60

Uniqueness

Uniqueness Score: -1.00%

Function 013397D9 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1943645778.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1330000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5fa7fa3e8cf979531330f1cabb026d355cf481887aef44ce4aff0f31e21d2be
Instruction ID: 16890287ee12d3f5c461f94315428c71e9bc6dfcab9ed8ba5ac863c29a8ff68f
Opcode Fuzzy Hash: c5fa7fa3e8cf979531330f1cabb026d355cf481887aef44ce4aff0f31e21d2be
Instruction Fuzzy Hash: 7901A972700311DFD7148F68E99492ABFB8FFCA32C31105AAE614CB391CA71EC048BA1

Uniqueness

Uniqueness Score: -1.00%

Function 01333CF8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1943645778.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1330000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3da6513bd87fcbd3be31e9959402ef1490bdceaf67c30364f4b7e16d6721ab46
Instruction ID: e040d256ba53fd463fe5cb235eb90d393726304ef3aaa30af2741db5422e1bcc
Opcode Fuzzy Hash: 3da6513bd87fcbd3be31e9959402ef1490bdceaf67c30364f4b7e16d6721ab46
Instruction Fuzzy Hash: B3111F3494030EDFCB09EBA8E9555AEBBB5FF84304F004529D525B73A8DB31A988CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01330DE0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1943645778.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1330000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4d8e8ae18bee4016fbfe06aa38c518cc997e6716eb461834201341e6c13422c
Instruction ID: 17fc96054a9931d99ad0f9d106401100ca2f06d551d879c81ace72cb27a4b9bb
Opcode Fuzzy Hash: e4d8e8ae18bee4016fbfe06aa38c518cc997e6716eb461834201341e6c13422c
Instruction Fuzzy Hash: 38115E712007448BC326EB69D51069F7BD6BB803187104929C0668B768DF76EC898FC4

Uniqueness

Uniqueness Score: -1.00%

Function 013308F8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1943645778.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1330000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48f4de71e3ed3a3c705f21a687fbe543710788c7d677285891328c679054be1e
Instruction ID: 97e5a8f51bf5d925a2bf29ef46e47e4fd821cd1fc1ef32e4ea1e3db554f6684c
Opcode Fuzzy Hash: 48f4de71e3ed3a3c705f21a687fbe543710788c7d677285891328c679054be1e
Instruction Fuzzy Hash: 291110B59007088FDB20DFAAC444BDEBFF4EB88324F20845AE459A7220C375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01337901 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1943645778.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1330000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e1bb65f830136070e6a6ed65ee21c516bcb856ff25245f66584abaf7587385c
Instruction ID: 3d9fded326359619a78d469ca1358794cfb78f773bf2ce38cc7096982810ce19
Opcode Fuzzy Hash: 4e1bb65f830136070e6a6ed65ee21c516bcb856ff25245f66584abaf7587385c
Instruction Fuzzy Hash: 29015A706086568FCB05AF7CD654219BBE1AF8A320F4149AED4C5CB360DB34AC409B96

Uniqueness

Uniqueness Score: -1.00%

Function 01330900 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1943645778.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1330000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab992b141748f17ed02c615576653e2d40f0ded04e37af5e441955519999e52b
Instruction ID: 5ce7748df7ee86e2fc347391ab3c1804e77512ffabdded72214c480471bf230d
Opcode Fuzzy Hash: ab992b141748f17ed02c615576653e2d40f0ded04e37af5e441955519999e52b
Instruction Fuzzy Hash: 661100B59007498FDB20DFAAC448BDEBBF4EB48324F208419D559A7260C375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01330880 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1943645778.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1330000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79122e7d4a4fbe92480a19daf3be8e1ffddc7babbbc929c6876835c4d3c5ef2b
Instruction ID: e6b606750f8c0900199f6b9b332763f95981df765cf8c1de95c1ce8464999e03
Opcode Fuzzy Hash: 79122e7d4a4fbe92480a19daf3be8e1ffddc7babbbc929c6876835c4d3c5ef2b
Instruction Fuzzy Hash: EC01C272A40305AFCF0D9BB4C8115AE3FB6EFD6268F1049BEE114DB1B4DA368441D744

Uniqueness

Uniqueness Score: -1.00%

Function 013396C0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1943645778.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1330000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3340f9f00c6ffb7e297b6201e42b6e28810b69238b0457973abdab255029b841
Instruction ID: e93050388bc84a70a57b4cc20eb574a1a7bbcf6ae5aa9560ccc754474f11aa6d
Opcode Fuzzy Hash: 3340f9f00c6ffb7e297b6201e42b6e28810b69238b0457973abdab255029b841
Instruction Fuzzy Hash: 68F0C832B462418FDB155B7CB4185ACBB94EFC922531408FBE806CB345DE65CC11C784

Uniqueness

Uniqueness Score: -1.00%

Function 01330EA0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1943645778.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1330000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aa5fe6e163b0726a671bee3d83eeb72ccc308c260e2dd31d2a8b758e76fdaaf
Instruction ID: 4595241edd5b9eafaf4d1f5b57fab4afb9db1836ad1e8c687729dc9d898132bf
Opcode Fuzzy Hash: 1aa5fe6e163b0726a671bee3d83eeb72ccc308c260e2dd31d2a8b758e76fdaaf
Instruction Fuzzy Hash: 7FF055723042048FC31A5BBCA82016A3FA6FAC124930046BAD005CF3B8DB2AC88AC780

Uniqueness

Uniqueness Score: -1.00%

Function 01330839 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1943645778.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1330000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68f3b48282966b66a6a7569ca5a032266fb1a106b5da2062bb2af7f0c8bc7486
Instruction ID: 50aa9aca9d2ae2d8be68fab218658a6fbadaf74cec3fc4c541bcef23c128d73f
Opcode Fuzzy Hash: 68f3b48282966b66a6a7569ca5a032266fb1a106b5da2062bb2af7f0c8bc7486
Instruction Fuzzy Hash: 32E04F300443899FCB6ADB68E955B457FB0FB52358F0506B6D0845B23AC7765698CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01339690 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1943645778.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1330000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ff8e4d4666427aaf91f2bc0926d95dacb0e7d43cae252beb91e712568bdea3f
Instruction ID: 84345ac91f13cbbde537c95d9f304e90ac70c8a3a4409f129d2a90629fa82e86
Opcode Fuzzy Hash: 6ff8e4d4666427aaf91f2bc0926d95dacb0e7d43cae252beb91e712568bdea3f
Instruction Fuzzy Hash: 22D0A931A802099BCB14EFB4852096EBBA9AB48200B004EAA980ACB304EE318F000692

Uniqueness

Uniqueness Score: -1.00%

Function 013396D0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1943645778.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1330000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d76c61774dbebdc3d183dfeb14a21c6c5993f14bd0747a3df4c64d3f3e02c40
Instruction ID: d8cf9f7f071ce8549705f47b9f0e00dbf7633bc87bd8f06d3b334372adb2db70
Opcode Fuzzy Hash: 1d76c61774dbebdc3d183dfeb14a21c6c5993f14bd0747a3df4c64d3f3e02c40
Instruction Fuzzy Hash: 95D01231B423148BDB142B78A00C8ADB7D9FB8D12230008BAE406C3300DE76CC1187C0

Uniqueness

Uniqueness Score: -1.00%

Function 01330848 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1943645778.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1330000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb79a5a1d9514f2eb90d7d3d9006f18e61f46554766e417539fa3f3295c6986c
Instruction ID: da1d166a50c4682acb14a63e1729c246f25221fc479227d1896f1f3ab70384f8
Opcode Fuzzy Hash: bb79a5a1d9514f2eb90d7d3d9006f18e61f46554766e417539fa3f3295c6986c
Instruction Fuzzy Hash: 04D052310042898ECA2AEB2CF81AB0A7F58B700208F000171D0480B63ECBA6A4888BD0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: M5vARlA2c4.exePID: 6460, Parent PID: 2580COMMON

Executed Functions

Function 01548E98 Relevance: 2.6, Strings: 2, Instructions: 105COMMON

Download Yara Rule

Strings

Hoq, xrefs: 01548F06
Hoq, xrefs: 01548F65

Memory Dump Source

Source File: 00000006.00000002.2027336905.0000000001540000.00000040.00000800.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1540000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID: Hoq$Hoq
API String ID: 0-3106737575
Opcode ID: 78a35925b475bdf34da195bead05116d57f9f9d69b025c2f42d2aef4c13b5be6
Instruction ID: a9ca6406231b1be2790c554e0ebbddb0c1f69bcf02f523b124decfd6a50f87f3
Opcode Fuzzy Hash: 78a35925b475bdf34da195bead05116d57f9f9d69b025c2f42d2aef4c13b5be6
Instruction Fuzzy Hash: 5B31AF34B002169FDB69AABC851467F39E7BBD4768B248528A625DF3C4DF34CD0683D1

Uniqueness

Uniqueness Score: -1.00%

Function 015480C0 Relevance: 1.8, Strings: 1, Instructions: 562COMMON

Download Yara Rule

Strings

doq, xrefs: 01548475

Memory Dump Source

Source File: 00000006.00000002.2027336905.0000000001540000.00000040.00000800.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1540000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID: doq
API String ID: 0-3318987180
Opcode ID: a4077cfbcaf2483ece7c52327e465083b18990ff1f9ee687d35a7c53799554b0
Instruction ID: ed153e81002583d4a3195c61f52986cb7b804d35cfddf52d91c1d5b6c1424875
Opcode Fuzzy Hash: a4077cfbcaf2483ece7c52327e465083b18990ff1f9ee687d35a7c53799554b0
Instruction Fuzzy Hash: 13221874A00315CFDB24EF74D994BAA7BB6FB48304F1045A9E909AB3A4DB399D85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 015476A9 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

Tekq, xrefs: 015477EA

Memory Dump Source

Source File: 00000006.00000002.2027336905.0000000001540000.00000040.00000800.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1540000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: 73af4932b6d7fdcb97a1507bcbb16dc2251f30cbd6e855175a8cb43fc421018b
Instruction ID: 61d625e076ec94daf922d18cb6e77822dc3cc1421a1ebf781a3d6774433c338f
Opcode Fuzzy Hash: 73af4932b6d7fdcb97a1507bcbb16dc2251f30cbd6e855175a8cb43fc421018b
Instruction Fuzzy Hash: 4451CF70640346CFCB05FF68E98098A7BB9FB44344B10A675D405AB369DB7CAE59CF80

Uniqueness

Uniqueness Score: -1.00%

Function 015476B8 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

Tekq, xrefs: 015477EA

Memory Dump Source

Source File: 00000006.00000002.2027336905.0000000001540000.00000040.00000800.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1540000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: 55a0bea6ad6ec6aa7256e7d724927d49d7fbf0ac9d622d30b263c4fa2c34a312
Instruction ID: 3661c0f26cba592a28d04723699baa9fd1e9dd200350da399259c8e953a4b343
Opcode Fuzzy Hash: 55a0bea6ad6ec6aa7256e7d724927d49d7fbf0ac9d622d30b263c4fa2c34a312
Instruction Fuzzy Hash: 5F51CE70600346CFCB05FF68EA8494ABBB9FB44344B10A674D405AB369DB7CAE59CF80

Uniqueness

Uniqueness Score: -1.00%

Function 01540DCF Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

4'kq, xrefs: 01540DA8

Memory Dump Source

Source File: 00000006.00000002.2027336905.0000000001540000.00000040.00000800.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1540000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: 79f03ccdd24d69eea7496e62b137c71887e7ad8817f9c427ae79375ca0c29ef4
Instruction ID: 3f71944f9fc8bfb584fbbfb0b6b87835d38656c4bfae2c0dcdb32580ab1131fb
Opcode Fuzzy Hash: 79f03ccdd24d69eea7496e62b137c71887e7ad8817f9c427ae79375ca0c29ef4
Instruction Fuzzy Hash: 613158706003458FC716EF78E9146AE7BE6FB81314B10897DC455AB3A8DB79EC4A8B81

Uniqueness

Uniqueness Score: -1.00%

Function 015492A9 Relevance: .5, Instructions: 503COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2027336905.0000000001540000.00000040.00000800.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1540000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fed195cdad469ecbf728d28339553e11c33af89a5bd5fdc59662ad827f18414
Instruction ID: 83f8a211e5b6f17a8f3012af0d80cbbfea79023374e9770a559b810caf836a3d
Opcode Fuzzy Hash: 0fed195cdad469ecbf728d28339553e11c33af89a5bd5fdc59662ad827f18414
Instruction Fuzzy Hash: 9FE0DF30945348AFC720EFB4D8126797FB4EB42200F400A9AE482CB222EE349A008752

Uniqueness

Uniqueness Score: -1.00%

Function 01549275 Relevance: .5, Instructions: 474COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2027336905.0000000001540000.00000040.00000800.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1540000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efab01ca8d0b258d050944e3b2356adfd0dea2c9eb163f39bb1e7e258e666840
Instruction ID: 62f657fde528ed2f069630bc1197d383fdf1eea3b0a3611ca230cf3824083771
Opcode Fuzzy Hash: efab01ca8d0b258d050944e3b2356adfd0dea2c9eb163f39bb1e7e258e666840
Instruction Fuzzy Hash: 39E09B71D057485BD715EFF8952267D3B65EB52204F414A9BD445CB117EE348A008391

Uniqueness

Uniqueness Score: -1.00%

Function 01549707 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2027336905.0000000001540000.00000040.00000800.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1540000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b81ed12338de727ee08e6063d618559e8e431b3449ce816fe4516430e514dde
Instruction ID: 3cd13c0dd339cf1b155f4572695504fd6b30c2ab8dbd12d5c6982969982d7d2b
Opcode Fuzzy Hash: 4b81ed12338de727ee08e6063d618559e8e431b3449ce816fe4516430e514dde
Instruction Fuzzy Hash: 9D014C719423415BC711EBF8A503B6E7B69FF46218F400569D481CF325EF348A01C351

Uniqueness

Uniqueness Score: -1.00%

Function 01543DF0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2027336905.0000000001540000.00000040.00000800.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1540000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 906a3c55f9947c34c66b27cbd58d0a3e0d3de0637f6a94851f0132e8e5ab8299
Instruction ID: 308a8a067bc48a0ed81e9e9603d14900905d050e1b7fb2060c1ea8163f220901
Opcode Fuzzy Hash: 906a3c55f9947c34c66b27cbd58d0a3e0d3de0637f6a94851f0132e8e5ab8299
Instruction Fuzzy Hash: E3416B30B003159FDB15AF78D91476F3BEEEB88740F108469A505EB3E8DB399C498B91

Uniqueness

Uniqueness Score: -1.00%

Function 01543E00 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2027336905.0000000001540000.00000040.00000800.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1540000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38727180564e5722de6808d95ed2ba95f654eeaf0cc19f45b84ba330f0d84f68
Instruction ID: 4e6e38c8e9ab12a64d5630c0e3dc70e22b66b640cde4e376725289875a756e26
Opcode Fuzzy Hash: 38727180564e5722de6808d95ed2ba95f654eeaf0cc19f45b84ba330f0d84f68
Instruction Fuzzy Hash: 93314830B003159FDB19AF78D91476F7BEEEB88700F108469A505AB3A8DA399C458B91

Uniqueness

Uniqueness Score: -1.00%

Function 01540890 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2027336905.0000000001540000.00000040.00000800.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1540000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79204c4277afbd287932e4d08e782bc095c57819ca8a417bd7843a434160c116
Instruction ID: 828cc98d36eb4e27ba97ccb3edbc528e16c5f17a7b23623beda27c8e00d18c62
Opcode Fuzzy Hash: 79204c4277afbd287932e4d08e782bc095c57819ca8a417bd7843a434160c116
Instruction Fuzzy Hash: 43318DB19003099FDB14DFA9C845BDEBFF5FF89324F208869E655AB291D7359840CB90

Uniqueness

Uniqueness Score: -1.00%

Function 015497D8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2027336905.0000000001540000.00000040.00000800.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1540000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 900c85d3674d21815eb0e84a12cc40daa2fca6a370396a31127a7ea478786a8a
Instruction ID: 4a3396fc3deab9de95e7e308f9191b4ded80ee4c33089ebab638cfc8a9981ae3
Opcode Fuzzy Hash: 900c85d3674d21815eb0e84a12cc40daa2fca6a370396a31127a7ea478786a8a
Instruction Fuzzy Hash: EE21AB71708314DFE7249F6CE88592A7BB9FB89218B1104A9D505CB391DA38EC05CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 01540994 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2027336905.0000000001540000.00000040.00000800.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1540000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 564c7b8b83b922f7c94423a0f6455085fd29359cc45d38c4d4a149e055e44645
Instruction ID: 031e4d93efb09948de564376a9d7785bc42b8a01690f0bd4e98e1175f951bd6c
Opcode Fuzzy Hash: 564c7b8b83b922f7c94423a0f6455085fd29359cc45d38c4d4a149e055e44645
Instruction Fuzzy Hash: 073101B0D01248DFCB14CFA9D584BDDBFF5AF48314F24806AE408AB264C7B56946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 015409A0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2027336905.0000000001540000.00000040.00000800.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1540000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d8a0ac6171e561816ad86181aa2c92a265bff42b4057a832239bee3c5e718ef
Instruction ID: 085492571727b66645c57838274106d7a5111bd2480563d3a3395ec340cfa8e4
Opcode Fuzzy Hash: 0d8a0ac6171e561816ad86181aa2c92a265bff42b4057a832239bee3c5e718ef
Instruction Fuzzy Hash: F531D0B0D01258DFCB14CF99D584BDDBFF5AF48314F24806AE508AB2A4CBB5A945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01543CE9 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2027336905.0000000001540000.00000040.00000800.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1540000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e8d559be983bb33b27b9bd0f9f91e9dd392b73a4826a6dac1ef5ef25aa4a68f
Instruction ID: df2ed0a4597fdb1697f1c519d2061fe1836aeca6b55d53d8658f679a102a38d5
Opcode Fuzzy Hash: 2e8d559be983bb33b27b9bd0f9f91e9dd392b73a4826a6dac1ef5ef25aa4a68f
Instruction Fuzzy Hash: 6E212C34D0020A9FDB10FFA8E8455AEBBB9FB84304F504569D505BB2D4DB35AE4ACF91

Uniqueness

Uniqueness Score: -1.00%

Function 01543CF8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2027336905.0000000001540000.00000040.00000800.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1540000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16a19dc795de150f5d27ca455c97db216dbe41ddf3f64d74af6f3b1ad6c5d0df
Instruction ID: 31a21cea2d86f196c153ca34220193ae3f9ec9eb9647278bf90f1659c8097b73
Opcode Fuzzy Hash: 16a19dc795de150f5d27ca455c97db216dbe41ddf3f64d74af6f3b1ad6c5d0df
Instruction Fuzzy Hash: D611F930D0020A9FDB10EFA8E8555AEBBB9FB84304F104568D505BB294DB35AE49CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 015497C9 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2027336905.0000000001540000.00000040.00000800.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1540000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f1ec879573ef07bde30cbdad4b57c2adaff74bba7a88f514e63caa82c8243a0
Instruction ID: 83bd93c86e63726d17cfa8a077eedeaf6f9137120e0bb981be68f3302bbee34d
Opcode Fuzzy Hash: 9f1ec879573ef07bde30cbdad4b57c2adaff74bba7a88f514e63caa82c8243a0
Instruction Fuzzy Hash: E901B175704710DFE7149F6DE88682A7BB8FB8D718B11456AE504CB350DB30EC00CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01540DE0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2027336905.0000000001540000.00000040.00000800.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1540000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a33ebcc0cffedadffadb1c4c6e4cf94f6d94e1441f092e31db98e7a5d42dc09a
Instruction ID: 9b7d14c629bc8cc784f86e9b851980d619c0b52db15e0396ab3d2e5c3e2970ae
Opcode Fuzzy Hash: a33ebcc0cffedadffadb1c4c6e4cf94f6d94e1441f092e31db98e7a5d42dc09a
Instruction Fuzzy Hash: 171148712007408BC325EF79E51469A7BEAFB84754B10892CC0169B7A8DF79EC8A8FC1

Uniqueness

Uniqueness Score: -1.00%

Function 01543FF4 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2027336905.0000000001540000.00000040.00000800.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1540000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fa6a3d89cd4beefbc39cb7f49836ec48bc8b041551c464463311c022d23c92b
Instruction ID: ca283027e60a3923f5b1cc3349d9d50705412e6bc132af5774ff388ccb4c98a0
Opcode Fuzzy Hash: 9fa6a3d89cd4beefbc39cb7f49836ec48bc8b041551c464463311c022d23c92b
Instruction Fuzzy Hash: C81110B59003588FCB20DF99C848BDEBFF5FB58324F208859E959AB250C775A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 01547609 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2027336905.0000000001540000.00000040.00000800.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1540000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 773d63004e2cf851245630f517163ef9a58644b1c65fea9e4313c02f9678eeec
Instruction ID: 10f86ed39f4006f9939cfcacc03393c66f2a1ae602ade50848a2383411980e01
Opcode Fuzzy Hash: 773d63004e2cf851245630f517163ef9a58644b1c65fea9e4313c02f9678eeec
Instruction Fuzzy Hash: 471110B59002588FDB20DF99D848BDEBFF4FB59324F20845AE958A7250C735A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 015408F8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2027336905.0000000001540000.00000040.00000800.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1540000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db9ebd6b4b2c11fbcc420ba45d57fb6a87760331af8b1914e9ed1c206578aeff
Instruction ID: f3f8cf9090cf24856a480aa9e1b803591f2000d157d26b1ea7cc12bf67edac88
Opcode Fuzzy Hash: db9ebd6b4b2c11fbcc420ba45d57fb6a87760331af8b1914e9ed1c206578aeff
Instruction Fuzzy Hash: A71122B59003598FDB20DFA9C484BDEBFF4AF48324F20845AD559A7251C375A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 015478FF Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2027336905.0000000001540000.00000040.00000800.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1540000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b063d6c2defd573eac3189d80367af9e17c693615e6f1bdee46efeb963588655
Instruction ID: 6042da55d43d6d13a52e0a7ed8f316cfb2b39d8ae0a7d6a4a490773df9355c59
Opcode Fuzzy Hash: b063d6c2defd573eac3189d80367af9e17c693615e6f1bdee46efeb963588655
Instruction Fuzzy Hash: 36017835604215CFDB04EF3CE64462EB7E1BF8A310F91492EE4899B354EB34AD408B92

Uniqueness

Uniqueness Score: -1.00%

Function 01540900 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2027336905.0000000001540000.00000040.00000800.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1540000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a75603d40aaba0e2bdf02f97581c683af8ad663526aa5495a6bcf3081b21d6c8
Instruction ID: d53544277df0042e9ced88dd6213c0d406d5e3780534b9f19162a1bfeca34ffc
Opcode Fuzzy Hash: a75603d40aaba0e2bdf02f97581c683af8ad663526aa5495a6bcf3081b21d6c8
Instruction Fuzzy Hash: 941130B59003198FDB20DFAAC448BDEBFF4EB48324F208459D558A7250C335A980CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01540880 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2027336905.0000000001540000.00000040.00000800.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1540000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 370b864acbbaf233b6c5f47ac05e11b64b6cafbdc27f91a11be18eac58f248af
Instruction ID: 52ccd05ba76a45636584ce27079dd2486ab4668c774d1a88220fa80219e30011
Opcode Fuzzy Hash: 370b864acbbaf233b6c5f47ac05e11b64b6cafbdc27f91a11be18eac58f248af
Instruction Fuzzy Hash: 78F0C871A04345AFDF099B748C115EE3F76FFD2218F2448AAE245DF2E2D93244119740

Uniqueness

Uniqueness Score: -1.00%

Function 01540EA0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2027336905.0000000001540000.00000040.00000800.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1540000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec8548a605c6eb2bc9d05828e5172aed29aafa21b5a2beb4b8aef2a95753a4b9
Instruction ID: 25111c76c5321e172fddc2f879dc17e8232f3a0798d05b7f56d5d28a9e57165b
Opcode Fuzzy Hash: ec8548a605c6eb2bc9d05828e5172aed29aafa21b5a2beb4b8aef2a95753a4b9
Instruction Fuzzy Hash: 89F055722043108FC3259FB8A8240AA3FE6FA8128532049BED105CF3A8DB39DC46CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 015496B1 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2027336905.0000000001540000.00000040.00000800.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1540000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69ca52356a3969e0469a5cc3a80b62efe5428346e51b68d848c134ac3baac03b
Instruction ID: 699fd86239b2ba28bc090abb93e3544d548c64cd266dc346b2eb2a182c538495
Opcode Fuzzy Hash: 69ca52356a3969e0469a5cc3a80b62efe5428346e51b68d848c134ac3baac03b
Instruction Fuzzy Hash: 2DD05E3461271CDBC7286FB4B20AAA43FA9FB89311F1111BAF90582321EF768C01D790

Uniqueness

Uniqueness Score: -1.00%

Function 01540839 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2027336905.0000000001540000.00000040.00000800.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1540000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b05cd827857fa90d971c45e774cda358cc23a52d7aec979d02ba71b47e13e399
Instruction ID: 1f4d6d26808816cf0020952de8218d50a977767cd942ce9a6bb5f01f91644e9c
Opcode Fuzzy Hash: b05cd827857fa90d971c45e774cda358cc23a52d7aec979d02ba71b47e13e399
Instruction Fuzzy Hash: F7E01A301443858FCB26DF68E4447467FE8EB46354F0641AAC484AF2A6D3B859588BD1

Uniqueness

Uniqueness Score: -1.00%

Function 01549680 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2027336905.0000000001540000.00000040.00000800.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1540000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ce8e91239baac27a3a79576d1c5f418ce176c4bee77a026a0131319e45bc8c1
Instruction ID: 5eec3ee2412cb94ae398a21d00e58c0b26ff9881adcfb63520c167550c732af1
Opcode Fuzzy Hash: 7ce8e91239baac27a3a79576d1c5f418ce176c4bee77a026a0131319e45bc8c1
Instruction Fuzzy Hash: 84D0A771A4030C5BCB14EFB4451157E7BA9DB44100B404A999406CB204ED318F004692

Uniqueness

Uniqueness Score: -1.00%

Function 01540848 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2027336905.0000000001540000.00000040.00000800.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1540000_M5vARlA2c4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53ec78dad282a9b541ae5a0a9790036a8a9170a40f2b8967eb1f72f297172987
Instruction ID: 0cdaf598a9734bb83e8cab9d4f4280e0dc687f60af861e6515819660ea9d4b5c
Opcode Fuzzy Hash: 53ec78dad282a9b541ae5a0a9790036a8a9170a40f2b8967eb1f72f297172987
Instruction Fuzzy Hash: E7D052302043898ECB32EF28F8097027F9CE744308F0041A8D008AF2AAD7BCA8188BC1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Java update.exePID: 6168, Parent PID: 2580COMMON

Executed Functions

Function 00E81F00 Relevance: 1.7, Strings: 1, Instructions: 463COMMON

Download Yara Rule

Strings

doq, xrefs: 00E821E5

Memory Dump Source

Source File: 00000007.00000002.2111006941.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e80000_Java update.jbxd

Similarity

API ID:
String ID: doq
API String ID: 0-3318987180
Opcode ID: f151b37d18f60845b3644a42625c98e93b85d1820750e47bb6bd7d6797210a2d
Instruction ID: d99a397d2961025ca299985f5c93de98e45a40488a07a8438e8d768386e49019
Opcode Fuzzy Hash: f151b37d18f60845b3644a42625c98e93b85d1820750e47bb6bd7d6797210a2d
Instruction Fuzzy Hash: D2223B74A10214CFDB15EF34E994BA977B2FB48300F1085ADE909A73AADB399D81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00E81F10 Relevance: 1.7, Strings: 1, Instructions: 451COMMON

Download Yara Rule

Strings

doq, xrefs: 00E821E5

Memory Dump Source

Source File: 00000007.00000002.2111006941.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e80000_Java update.jbxd

Similarity

API ID:
String ID: doq
API String ID: 0-3318987180
Opcode ID: ebab7fa3956a318e17f39ac7cdada0be881f5fd1fdfa4276e3ef54631189bb16
Instruction ID: 3045e1cdfc4906805321321144b5efeb08453f924a72e96f6a149b0179af4955
Opcode Fuzzy Hash: ebab7fa3956a318e17f39ac7cdada0be881f5fd1fdfa4276e3ef54631189bb16
Instruction Fuzzy Hash: F2220774A10214CFDB25EF34ED94BA97BB2FB48300F1085A9E919A73A5DB399D81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00E82184 Relevance: 1.6, Strings: 1, Instructions: 305COMMON

Download Yara Rule

Strings

doq, xrefs: 00E821E5

Memory Dump Source

Source File: 00000007.00000002.2111006941.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e80000_Java update.jbxd

Similarity

API ID:
String ID: doq
API String ID: 0-3318987180
Opcode ID: 66f98a7be03e11e94684fa6c0cd35086296aac43b20746484aa2a2797325fac5
Instruction ID: 1d23bbe20ee5a95b84c28ad35f34f88fdb90c95fd10a3be2697ea6fb8dd2da49
Opcode Fuzzy Hash: 66f98a7be03e11e94684fa6c0cd35086296aac43b20746484aa2a2797325fac5
Instruction Fuzzy Hash: 78E1E374A10214CFDB29EF74D994BADBBB2FB48304F1084A9D909A7366DB399D81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00E81700 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

Tekq, xrefs: 00E81842

Memory Dump Source

Source File: 00000007.00000002.2111006941.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e80000_Java update.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: b3a924af17bc79ea37d639748f6847837bee5517087f35f90c1e8b84b8d4b6a5
Instruction ID: aa695153a7f1af9023441e037dbf6eead546c3ce8b78bfd7ded16f18eda0c573
Opcode Fuzzy Hash: b3a924af17bc79ea37d639748f6847837bee5517087f35f90c1e8b84b8d4b6a5
Instruction Fuzzy Hash: E551BF745602458FDB06FF68F990A99BBB1FB88304B10DA6DD4048732FDB78A949CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00E81710 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

Tekq, xrefs: 00E81842

Memory Dump Source

Source File: 00000007.00000002.2111006941.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e80000_Java update.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: cf5fcc940440e6de39df716cab2b7c30ffa39885e4b3270c69e43fd93988f7ee
Instruction ID: 15d23e14c73805769654269c09947f90b199e09ef6607c8db236e29726074cd1
Opcode Fuzzy Hash: cf5fcc940440e6de39df716cab2b7c30ffa39885e4b3270c69e43fd93988f7ee
Instruction Fuzzy Hash: 0551AC745602458FDB05FF68F984A99BBB1FB88304B10DA69D4048B32FDB78A949CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00E80DCF Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

4'kq, xrefs: 00E80DA8

Memory Dump Source

Source File: 00000007.00000002.2111006941.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e80000_Java update.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: e637efe9bab4b867fa5f52dcae42238179ef6e3a39b0b6370ff8eba007187dc8
Instruction ID: ef9babc02ef739de9939c6eb98b9604808ead55efd6397db7fc2998a9c2868e1
Opcode Fuzzy Hash: e637efe9bab4b867fa5f52dcae42238179ef6e3a39b0b6370ff8eba007187dc8
Instruction Fuzzy Hash: E8318F706042458FC715FB78E910A9E7BA2EF81304B108A6EC015AF7B9DB79ED49CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00E89299 Relevance: .5, Instructions: 528COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2111006941.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e80000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1743f2f9aff3b8b029c019b00bc628739aa1d81e0ebb8903bde7af6f5fe117a8
Instruction ID: d3d0406e4b214c325c0f66d8bfb06548fe7b9b0107260ca328c406bd5159e1c9
Opcode Fuzzy Hash: 1743f2f9aff3b8b029c019b00bc628739aa1d81e0ebb8903bde7af6f5fe117a8
Instruction Fuzzy Hash: F6F092305493845FCB16BBB488201693FB4DF4321170A09E7D44EDB293EE359E09ABB3

Uniqueness

Uniqueness Score: -1.00%

Function 00E89265 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2111006941.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e80000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91d4541615cec82200b0f3d597bc9eaaad52805c1e4498f987592da33ef46ca4
Instruction ID: 9683d0587d41ca8674cbc459932a7e1e3638ab0569898431ab106b26a29a2b1b
Opcode Fuzzy Hash: 91d4541615cec82200b0f3d597bc9eaaad52805c1e4498f987592da33ef46ca4
Instruction Fuzzy Hash: 29E02B30A093485FCB16BBF419200BD3FA0DF422007410AE7D44AD7257ED30DE0957B6

Uniqueness

Uniqueness Score: -1.00%

Function 00E85762 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2111006941.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e80000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3e9fb6024577e26386bbe6fa451c020f2191c0359ea3cd0489f7a608323a4ec
Instruction ID: 82ab65f1e8521a444ed87dd6e5bac87e11157b9f4b732a0a4734c22383993231
Opcode Fuzzy Hash: f3e9fb6024577e26386bbe6fa451c020f2191c0359ea3cd0489f7a608323a4ec
Instruction Fuzzy Hash: 58418330B102158FDB49FB74D91576E3BAAAB84300F10847DD509E73AADF399D89CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00E85770 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2111006941.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e80000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1dccada2fc59d87eff8f4f08e5b81d70d9a9c8bd1c41abcb9faf98df9272bff
Instruction ID: 061e8c892ccf13605d2a4e11828c7ec12862bb7f99e04a992079c25a184e2e05
Opcode Fuzzy Hash: f1dccada2fc59d87eff8f4f08e5b81d70d9a9c8bd1c41abcb9faf98df9272bff
Instruction Fuzzy Hash: 1231A330B102148FDB49FB78D91576E3BEAAB88700F10846DD509E73A9DF399D49CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00E80890 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2111006941.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e80000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24740229795a15cb1baba816c8474b716cc46ad41c61d16d1832be1677531281
Instruction ID: 1739b6b70fc36b53d6ec8f2683f99592701fe76c7af97b16ba6de4d2246c4aee
Opcode Fuzzy Hash: 24740229795a15cb1baba816c8474b716cc46ad41c61d16d1832be1677531281
Instruction Fuzzy Hash: 2A319FB1A003488FCB14EFB9D845B9EBFF5EF88320F108469D119A7661D7359444CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00E80994 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2111006941.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e80000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cc10a4d36179b5c80bc5168c5c9ba2759592c1bf8bd9ef6021235e236c97adb
Instruction ID: b80bb4c23f9fe7aade1ea30d47f8d646f4048df48dd7369767498bb55534ebdd
Opcode Fuzzy Hash: 8cc10a4d36179b5c80bc5168c5c9ba2759592c1bf8bd9ef6021235e236c97adb
Instruction Fuzzy Hash: 5331DEB0D01248DFCB14DFA9D584BDEBFF5AF88314F24806AE409BB264C775694ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 00E80610 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2111006941.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e80000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c5b5e1c871f37eabd722ce380807774efd455c654f5f9cd3779b1a5bfebef41
Instruction ID: 1eeff9c6a75832a60ffeeef83dc0f03569830a8e947a22c078131ac518e7fcba
Opcode Fuzzy Hash: 2c5b5e1c871f37eabd722ce380807774efd455c654f5f9cd3779b1a5bfebef41
Instruction Fuzzy Hash: 4431F2B0D01248DFCB14DFD9D584BDDBBF5AF88314F20806AE408BB264C774A949CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00E85658 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2111006941.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e80000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e89cc8626a3cf8bd0152e306601cf59ca8fbcf748213cf1956a2d8daf8b70048
Instruction ID: a430dad32011c6e63233033eb7d71bcfc03c7aad9a1b6fd28743316388b90df4
Opcode Fuzzy Hash: e89cc8626a3cf8bd0152e306601cf59ca8fbcf748213cf1956a2d8daf8b70048
Instruction Fuzzy Hash: BF218371D0010A9FDB05FBA8F855AEEBB71EF80304F40456DD006A73A6EF34AA49CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00E85158 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2111006941.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e80000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b461c91957cdbc5373ba868818adfe66059430465383a004833c01128329a2d9
Instruction ID: 5fa034f572956936ad326496fb9af3423d632b9fa8107afb2568fcf43105e8d1
Opcode Fuzzy Hash: b461c91957cdbc5373ba868818adfe66059430465383a004833c01128329a2d9
Instruction Fuzzy Hash: 091189B19003488FCB10DF99C544BDEBFF0EB48320F10805AD558A7251C774A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00E88F78 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2111006941.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e80000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 814c544b6ef49bb5fab7dc53b033129cf20b3915d93fe3cad3f002b035c7c939
Instruction ID: 53f419bbd3a2c2f2a6a9de5d343bae9d06d2b54ea8ed1400f264ed0a42fefa34
Opcode Fuzzy Hash: 814c544b6ef49bb5fab7dc53b033129cf20b3915d93fe3cad3f002b035c7c939
Instruction Fuzzy Hash: FA2144B1900249CFCB20DF9AD544BDEBFF4FB59324F20841AE958A7250C735A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E85668 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2111006941.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e80000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32cb693c6f6eafd1d11b300ce7e99bf6058037a9cb23cd48e2a71b26df7f22b1
Instruction ID: cb012ef08ff5f2ec5065907fa12dada3ab0ce9e4cccff6e191bfebfcbb6b158a
Opcode Fuzzy Hash: 32cb693c6f6eafd1d11b300ce7e99bf6058037a9cb23cd48e2a71b26df7f22b1
Instruction Fuzzy Hash: 25110A74A0010AAFCB05FBA8F855AAEBB75EF84304F408568D105A73A5DF34AA488B91

Uniqueness

Uniqueness Score: -1.00%

Function 00E85134 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2111006941.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e80000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 441160162738e7dcf404f0ea2cb54ededfc3069435c175bc3233d00851d41435
Instruction ID: ab6eb3749c841d5ea2236399f8c719e7bee80a0726ee5105fffe69dfb2be10b8
Opcode Fuzzy Hash: 441160162738e7dcf404f0ea2cb54ededfc3069435c175bc3233d00851d41435
Instruction Fuzzy Hash: 451102B59002488FCB20DF99D948BDEBBF5EB48324F20842AE959A7250C775A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00E80DE0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2111006941.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e80000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6061d0d4e0147d977d160b5f4bf12ef812223c3c48893d3f62a3292377b8f31f
Instruction ID: 932defee15a5014b535ce3fef7b794d338ed151695d5a2a2c3f5eeb561451c65
Opcode Fuzzy Hash: 6061d0d4e0147d977d160b5f4bf12ef812223c3c48893d3f62a3292377b8f31f
Instruction Fuzzy Hash: 19115A712007408BC315FB69E51579F7BA6AB80314B108A2DC0199B768DFBAED898FD4

Uniqueness

Uniqueness Score: -1.00%

Function 00E808F8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2111006941.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e80000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad2153bf0030d5912d8b21c4a0f29b6faac12af3c2a13dc0f941d83d6235073b
Instruction ID: 7766a14c6722f7963033927eef0be8710d7565e3809ae0feaf72782d6389926c
Opcode Fuzzy Hash: ad2153bf0030d5912d8b21c4a0f29b6faac12af3c2a13dc0f941d83d6235073b
Instruction Fuzzy Hash: 101125B59002488FCB20DFAAD449BDEBFF0EB88324F20845AD459A7351C375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00E80604 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2111006941.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e80000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cf59ab884e24bfb3a11364ff2233f4612141444aee28ec571a06fffcdb82344
Instruction ID: 9c68e2e2f10b9464e3cc69ab6f544eead94d981d8109a8a4e505a85a9aa6ac6a
Opcode Fuzzy Hash: 2cf59ab884e24bfb3a11364ff2233f4612141444aee28ec571a06fffcdb82344
Instruction Fuzzy Hash: F51122B19003088FDB20DF9AC448BDEBBF4EB88324F208469D459A7351C375A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00E89018 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2111006941.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e80000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f65ed23512384da018b02fc0a6191145e512ab78885925f7cf8b15eaff67d186
Instruction ID: 3bfd528c2b511c6bc460b9dc5697d4c5d48e9a79d550cc1b4ee2887c91ab1707
Opcode Fuzzy Hash: f65ed23512384da018b02fc0a6191145e512ab78885925f7cf8b15eaff67d186
Instruction Fuzzy Hash: 6F01BC30B08655CFCB01EB3CC650229BBE0EF89314F0508A9D48AEB352DB34ED05CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00E80880 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2111006941.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e80000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d9014fb2f9eb712fe92162b6f1b62db9740848112943615ad21a752cf5e0f54
Instruction ID: 3dd2310fa4cc6630f65fe04b9fe3f63d4787f73f32af75433c6f46bc023220eb
Opcode Fuzzy Hash: 7d9014fb2f9eb712fe92162b6f1b62db9740848112943615ad21a752cf5e0f54
Instruction Fuzzy Hash: 85F0C871A48344AFCF09AB748C159AD7F72AF82320F1446FED10DE76E2D97644569740

Uniqueness

Uniqueness Score: -1.00%

Function 00E80EA0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2111006941.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e80000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29bd5ff7424270bb37a99e668b8f4af1e5e087167bc7c1bede0f6639b1221bd3
Instruction ID: 1f7e9149f358101903735145dc115fa4a9fde63226136529315ed265c0f32075
Opcode Fuzzy Hash: 29bd5ff7424270bb37a99e668b8f4af1e5e087167bc7c1bede0f6639b1221bd3
Instruction Fuzzy Hash: 3CF05C713042008FC3517B78A8112593BA2EAC134131486BEC04DCF278DB29D84ACB80

Uniqueness

Uniqueness Score: -1.00%

Function 00E896A1 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2111006941.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e80000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e93cec2847c7dcc6134be5f438436c51664073732c2d5821629971708b331821
Instruction ID: 63ec79888ae27a27253cf7111476eb47a5e8d9232bab60268969bbf5e1446f6d
Opcode Fuzzy Hash: e93cec2847c7dcc6134be5f438436c51664073732c2d5821629971708b331821
Instruction Fuzzy Hash: B5E09230B863818FCB253B74642C0793FA59B8A2213050DBAF40EDB2D2DF3DC8598B51

Uniqueness

Uniqueness Score: -1.00%

Function 00E80839 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2111006941.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e80000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f14734a82af86e9092c24d32faf8642fb6ea51eefea9218b77ee0d7b677aad0
Instruction ID: 63814260a9a66f0fb80db48f1ab5a8bee36491c25eb510b47d079b381dc0cb1b
Opcode Fuzzy Hash: 6f14734a82af86e9092c24d32faf8642fb6ea51eefea9218b77ee0d7b677aad0
Instruction Fuzzy Hash: DFE04F301182C44FDB1BD738ED65F497F30A702204F0585DAC4405F277C668454DCB96

Uniqueness

Uniqueness Score: -1.00%

Function 00E896B0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2111006941.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e80000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2a1e31e514e15e7249ff393b3741f176e005991b45c1b7bc9b2017e2b073ebd
Instruction ID: 6308b810f1bcdff8a44a595eea77ddf044f76024346bdc41c64cc4b8307bcb03
Opcode Fuzzy Hash: e2a1e31e514e15e7249ff393b3741f176e005991b45c1b7bc9b2017e2b073ebd
Instruction Fuzzy Hash: D1D01231B81314DBC7242774A41C49977E9EB891263104C79F90AC3340DE7ACC168790

Uniqueness

Uniqueness Score: -1.00%

Function 00E80848 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2111006941.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e80000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f48bceee9edb2186c2f6ba87580ee8423ea73fc5fb46703499aac261d8900e97
Instruction ID: 5a1f5a59a83641390afaeb880af7e93265b5259103d2316a299ffc028dc25b4d
Opcode Fuzzy Hash: f48bceee9edb2186c2f6ba87580ee8423ea73fc5fb46703499aac261d8900e97
Instruction Fuzzy Hash: 3BD0A9300102898EDB0AEB28FC15B09BF68F300308F00C1A8D0081F33ACBBCA4088BC8

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report M5vARlA2c4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Njrat

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Java update.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\M5vARlA2c4.exe.log

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
M5vARlA2c4.exe

Function 00C3A7D7 Relevance: 1.8, APIs: 1, Instructions: 266
processCOMMON

Function 00C3A828 Relevance: 1.7, APIs: 1, Instructions: 215
processCOMMON

Function 04B52AE0 Relevance: 6.1, APIs: 4, Instructions: 137
threadCOMMON

Function 04B52AF0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 04B5A578 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Function 04B5CB44 Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Function 04B5BF7C Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Function 04B5C0CC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 04B52D30 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Function 04B526CC Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 04B59498 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON