Edit tour

Windows Analysis Report
oiA5KmV0f0.exe

Overview

General Information

Sample name:	oiA5KmV0f0.exe renamed because original name is a hash value
Original sample name:	1917739297383bb37d4f159e8540b70b.exe
Analysis ID:	1581727
MD5:	1917739297383bb37d4f159e8540b70b
SHA1:	12447834e3ce0745f5756f492aee4487c6c1cef4
SHA256:	431e12f989dd7a4c9d8235f4fa9f3e026a4b55921aa2fb4942563f857681f06c
Tags:	exenjratRATuser-abuse_ch
Infos:

Detection

Njrat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Njrat

.NET source code contains potential unpacker

AI detected suspicious sample

Disables zone checking for all users

Drops PE files to the startup folder

Machine Learning detection for dropped file

Machine Learning detection for sample

Protects its processes via BreakOnTermination flag

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: System File Execution Location Anomaly

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Dllhost Internet Connection

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

oiA5KmV0f0.exe (PID: 6552 cmdline: "C:\Users\user\Desktop\oiA5KmV0f0.exe" MD5: 1917739297383BB37D4F159E8540B70B)

Dllhost.exe (PID: 4464 cmdline: "C:\Users\user\AppData\Roaming\Dllhost.exe" MD5: 1917739297383BB37D4F159E8540B70B)

schtasks.exe (PID: 1816 cmdline: schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\user\AppData\Local\Temp/Server.exe MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 3808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Server.exe (PID: 6944 cmdline: C:\Users\user\AppData\Local\Temp/Server.exe MD5: 1917739297383BB37D4F159E8540B70B)

Dllhost.exe (PID: 1852 cmdline: "C:\Users\user\AppData\Roaming\Dllhost.exe" .. MD5: 1917739297383BB37D4F159E8540B70B)

Dllhost.exe (PID: 3300 cmdline: "C:\Users\user\AppData\Roaming\Dllhost.exe" .. MD5: 1917739297383BB37D4F159E8540B70B)

Dllhost.exe (PID: 6420 cmdline: "C:\Users\user\AppData\Roaming\Dllhost.exe" .. MD5: 1917739297383BB37D4F159E8540B70B)

Java update.exe (PID: 4076 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe" MD5: 1917739297383BB37D4F159E8540B70B)

Server.exe (PID: 2044 cmdline: C:\Users\user\AppData\Local\Temp/Server.exe MD5: 1917739297383BB37D4F159E8540B70B)

Server.exe (PID: 5672 cmdline: C:\Users\user\AppData\Local\Temp/Server.exe MD5: 1917739297383BB37D4F159E8540B70B)

Server.exe (PID: 8 cmdline: C:\Users\user\AppData\Local\Temp/Server.exe MD5: 1917739297383BB37D4F159E8540B70B)

Server.exe (PID: 6460 cmdline: C:\Users\user\AppData\Local\Temp/Server.exe MD5: 1917739297383BB37D4F159E8540B70B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
NjRAT	RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.	AQUATIC PANDA Earth Lusca Operation C-Major The Gorgon Group	http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-from-leaked-njw0rm-source-code/ http://blogs.360.cn/post/analysis-of-apt-c-37.html http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered-1.pdf https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ https://asec.ahnlab.com/1369	https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat

Malware Configuration

Threatname: Njrat

{"Install Dir": "AppData", "Install Name": "Dllhost.exe", "Startup": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Campaign ID": "HacKed", "Version": "Njrat 0.7 Golden By Hassan Amiri", "Network Seprator": "|Hassan|", "Mutex": "Windows Update", "Install Flag": ""}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
oiA5KmV0f0.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
oiA5KmV0f0.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x7cbd:$a1: get_Registry 0x93f0:$a2: SEE_MASK_NOZONECHECKS 0x9200:$a3: Download ERROR 0x9618:$a4: cmd.exe /c ping 0 -n 2 & del "
oiA5KmV0f0.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x9618:$x1: cmd.exe /c ping 0 -n 2 & del " 0x94a6:$x2: schtasks /create /sc minute /mo 1 /tn Server /tr 0x909a:$x3: www.upload.ee/image/ 0x90f2:$x3: www.upload.ee/image/ 0x914e:$x3: www.upload.ee/image/ 0x8d98:$s1: winmgmts:\\.\root\SecurityCenter2 0x948e:$s2: /Server.exe 0x9222:$s3: Executed As 0x724d:$s5: Stub.exe 0x9200:$s6: Download ERROR 0x8ebe:$s7: shutdown -r -t 00 0x8d5a:$s8: Select * From AntiVirusProduct
oiA5KmV0f0.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x93f0:$reg: SEE_MASK_NOZONECHECKS 0x91dc:$msg: Execute ERROR 0x923c:$msg: Execute ERROR 0x9618:$ping: cmd.exe /c ping 0 -n 2 & del

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\Dllhost.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Local\Temp\Server.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Roaming\Dllhost.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x7cbd:$a1: get_Registry 0x93f0:$a2: SEE_MASK_NOZONECHECKS 0x9200:$a3: Download ERROR 0x9618:$a4: cmd.exe /c ping 0 -n 2 & del "
C:\Users\user\AppData\Roaming\Dllhost.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x9618:$x1: cmd.exe /c ping 0 -n 2 & del " 0x94a6:$x2: schtasks /create /sc minute /mo 1 /tn Server /tr 0x909a:$x3: www.upload.ee/image/ 0x90f2:$x3: www.upload.ee/image/ 0x914e:$x3: www.upload.ee/image/ 0x8d98:$s1: winmgmts:\\.\root\SecurityCenter2 0x948e:$s2: /Server.exe 0x9222:$s3: Executed As 0x724d:$s5: Stub.exe 0x9200:$s6: Download ERROR 0x8ebe:$s7: shutdown -r -t 00 0x8d5a:$s8: Select * From AntiVirusProduct
C:\Users\user\AppData\Local\Temp\Server.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x7cbd:$a1: get_Registry 0x93f0:$a2: SEE_MASK_NOZONECHECKS 0x9200:$a3: Download ERROR 0x9618:$a4: cmd.exe /c ping 0 -n 2 & del "
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x7cbd:$a1: get_Registry 0x93f0:$a2: SEE_MASK_NOZONECHECKS 0x9200:$a3: Download ERROR 0x9618:$a4: cmd.exe /c ping 0 -n 2 & del "
C:\Users\user\AppData\Roaming\Dllhost.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x93f0:$reg: SEE_MASK_NOZONECHECKS 0x91dc:$msg: Execute ERROR 0x923c:$msg: Execute ERROR 0x9618:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Users\user\AppData\Local\Temp\Server.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x9618:$x1: cmd.exe /c ping 0 -n 2 & del " 0x94a6:$x2: schtasks /create /sc minute /mo 1 /tn Server /tr 0x909a:$x3: www.upload.ee/image/ 0x90f2:$x3: www.upload.ee/image/ 0x914e:$x3: www.upload.ee/image/ 0x8d98:$s1: winmgmts:\\.\root\SecurityCenter2 0x948e:$s2: /Server.exe 0x9222:$s3: Executed As 0x724d:$s5: Stub.exe 0x9200:$s6: Download ERROR 0x8ebe:$s7: shutdown -r -t 00 0x8d5a:$s8: Select * From AntiVirusProduct
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x9618:$x1: cmd.exe /c ping 0 -n 2 & del " 0x94a6:$x2: schtasks /create /sc minute /mo 1 /tn Server /tr 0x909a:$x3: www.upload.ee/image/ 0x90f2:$x3: www.upload.ee/image/ 0x914e:$x3: www.upload.ee/image/ 0x8d98:$s1: winmgmts:\\.\root\SecurityCenter2 0x948e:$s2: /Server.exe 0x9222:$s3: Executed As 0x724d:$s5: Stub.exe 0x9200:$s6: Download ERROR 0x8ebe:$s7: shutdown -r -t 00 0x8d5a:$s8: Select * From AntiVirusProduct
C:\Users\user\AppData\Local\Temp\Server.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x93f0:$reg: SEE_MASK_NOZONECHECKS 0x91dc:$msg: Execute ERROR 0x923c:$msg: Execute ERROR 0x9618:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x93f0:$reg: SEE_MASK_NOZONECHECKS 0x91dc:$msg: Execute ERROR 0x923c:$msg: Execute ERROR 0x9618:$ping: cmd.exe /c ping 0 -n 2 & del
Click to see the 7 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1717580034.000000000261E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000002.1717580034.000000000261E000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x1dcb9:$a1: get_Registry 0x1f3ec:$a2: SEE_MASK_NOZONECHECKS 0x1f1fc:$a3: Download ERROR 0x1f614:$a4: cmd.exe /c ping 0 -n 2 & del "
00000000.00000002.1717580034.000000000261E000.00000004.00000800.00020000.00000000.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x1f3ec:$reg: SEE_MASK_NOZONECHECKS 0x1f1d8:$msg: Execute ERROR 0x1f238:$msg: Execute ERROR 0x1f614:$ping: cmd.exe /c ping 0 -n 2 & del
00000000.00000002.1717580034.0000000002611000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000000.1649870964.0000000000372000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000000.1649870964.0000000000372000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x7abd:$a1: get_Registry 0x91f0:$a2: SEE_MASK_NOZONECHECKS 0x9000:$a3: Download ERROR 0x9418:$a4: cmd.exe /c ping 0 -n 2 & del "
00000000.00000000.1649870964.0000000000372000.00000002.00000001.01000000.00000003.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x91f0:$reg: SEE_MASK_NOZONECHECKS 0x8fdc:$msg: Execute ERROR 0x903c:$msg: Execute ERROR 0x9418:$ping: cmd.exe /c ping 0 -n 2 & del
Process Memory Space: oiA5KmV0f0.exe PID: 6552	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: Dllhost.exe PID: 4464	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: Server.exe PID: 6944	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: Java update.exe PID: 4076	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: Server.exe PID: 5672	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.oiA5KmV0f0.exe.370000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.0.oiA5KmV0f0.exe.370000.0.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x7cbd:$a1: get_Registry 0x93f0:$a2: SEE_MASK_NOZONECHECKS 0x9200:$a3: Download ERROR 0x9618:$a4: cmd.exe /c ping 0 -n 2 & del "
0.0.oiA5KmV0f0.exe.370000.0.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x9618:$x1: cmd.exe /c ping 0 -n 2 & del " 0x94a6:$x2: schtasks /create /sc minute /mo 1 /tn Server /tr 0x909a:$x3: www.upload.ee/image/ 0x90f2:$x3: www.upload.ee/image/ 0x914e:$x3: www.upload.ee/image/ 0x8d98:$s1: winmgmts:\\.\root\SecurityCenter2 0x948e:$s2: /Server.exe 0x9222:$s3: Executed As 0x724d:$s5: Stub.exe 0x9200:$s6: Download ERROR 0x8ebe:$s7: shutdown -r -t 00 0x8d5a:$s8: Select * From AntiVirusProduct
0.0.oiA5KmV0f0.exe.370000.0.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x93f0:$reg: SEE_MASK_NOZONECHECKS 0x91dc:$msg: Execute ERROR 0x923c:$msg: Execute ERROR 0x9618:$ping: cmd.exe /c ping 0 -n 2 & del
0.2.oiA5KmV0f0.exe.2633ffc.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.2.oiA5KmV0f0.exe.2633ffc.0.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x5ebd:$a1: get_Registry 0x75f0:$a2: SEE_MASK_NOZONECHECKS 0x7400:$a3: Download ERROR 0x7818:$a4: cmd.exe /c ping 0 -n 2 & del "
0.2.oiA5KmV0f0.exe.2633ffc.0.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x7818:$x1: cmd.exe /c ping 0 -n 2 & del " 0x76a6:$x2: schtasks /create /sc minute /mo 1 /tn Server /tr 0x729a:$x3: www.upload.ee/image/ 0x72f2:$x3: www.upload.ee/image/ 0x734e:$x3: www.upload.ee/image/ 0x6f98:$s1: winmgmts:\\.\root\SecurityCenter2 0x768e:$s2: /Server.exe 0x7422:$s3: Executed As 0x544d:$s5: Stub.exe 0x7400:$s6: Download ERROR 0x70be:$s7: shutdown -r -t 00 0x6f5a:$s8: Select * From AntiVirusProduct
0.2.oiA5KmV0f0.exe.2633ffc.0.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x75f0:$reg: SEE_MASK_NOZONECHECKS 0x73dc:$msg: Execute ERROR 0x743c:$msg: Execute ERROR 0x7818:$ping: cmd.exe /c ping 0 -n 2 & del
0.2.oiA5KmV0f0.exe.2633ffc.0.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.2.oiA5KmV0f0.exe.2633ffc.0.raw.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x7cbd:$a1: get_Registry 0x93f0:$a2: SEE_MASK_NOZONECHECKS 0x9200:$a3: Download ERROR 0x9618:$a4: cmd.exe /c ping 0 -n 2 & del "
0.2.oiA5KmV0f0.exe.2633ffc.0.raw.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x9618:$x1: cmd.exe /c ping 0 -n 2 & del " 0x94a6:$x2: schtasks /create /sc minute /mo 1 /tn Server /tr 0x909a:$x3: www.upload.ee/image/ 0x90f2:$x3: www.upload.ee/image/ 0x914e:$x3: www.upload.ee/image/ 0x8d98:$s1: winmgmts:\\.\root\SecurityCenter2 0x948e:$s2: /Server.exe 0x9222:$s3: Executed As 0x724d:$s5: Stub.exe 0x9200:$s6: Download ERROR 0x8ebe:$s7: shutdown -r -t 00 0x8d5a:$s8: Select * From AntiVirusProduct
0.2.oiA5KmV0f0.exe.2633ffc.0.raw.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x93f0:$reg: SEE_MASK_NOZONECHECKS 0x91dc:$msg: Execute ERROR 0x923c:$msg: Execute ERROR 0x9618:$ping: cmd.exe /c ping 0 -n 2 & del
Click to see the 7 entries

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\oiA5KmV0f0.exe, ProcessId: 6552, TargetFilename: C:\Users\user\AppData\Roaming\Dllhost.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Users\user\AppData\Roaming\Dllhost.exe" , CommandLine: "C:\Users\user\AppData\Roaming\Dllhost.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\Dllhost.exe, NewProcessName: C:\Users\user\AppData\Roaming\Dllhost.exe, OriginalFileName: C:\Users\user\AppData\Roaming\Dllhost.exe, ParentCommandLine: "C:\Users\user\Desktop\oiA5KmV0f0.exe", ParentImage: C:\Users\user\Desktop\oiA5KmV0f0.exe, ParentProcessId: 6552, ParentProcessName: oiA5KmV0f0.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\Dllhost.exe" , ProcessId: 4464, ProcessName: Dllhost.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Roaming\Dllhost.exe" .., EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\Dllhost.exe, ProcessId: 4464, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update

Sigma detected: Dllhost Internet Connection

Source: Network Connection

Author: bartblaze: Data: DestinationIp: 3.126.37.18, DestinationIsIpv6: false, DestinationPort: 11048, EventID: 3, Image: C:\Users\user\AppData\Roaming\Dllhost.exe, Initiated: true, ProcessId: 4464, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49730

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\Dllhost.exe, ProcessId: 4464, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\user\AppData\Local\Temp/Server.exe, CommandLine: schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\user\AppData\Local\Temp/Server.exe, CommandLine|base64offset|contains: mj,, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\Dllhost.exe" , ParentImage: C:\Users\user\AppData\Roaming\Dllhost.exe, ParentProcessId: 4464, ParentProcessName: Dllhost.exe, ProcessCommandLine: schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\user\AppData\Local\Temp/Server.exe, ProcessId: 1816, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Roaming\Dllhost.exe" .., EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\Dllhost.exe, ProcessId: 4464, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update

Suricata Signatures

ET MALWARE Bladabindi/njRAT CnC Command (ll)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T21:07:09.834020+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49730	3.126.37.18	11048	TCP
2024-12-28T21:07:13.943806+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49732	3.126.37.18	11048	TCP
2024-12-28T21:07:18.426111+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49736	3.126.37.18	11048	TCP
2024-12-28T21:07:23.275795+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49739	3.126.37.18	11048	TCP
2024-12-28T21:07:26.936209+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49740	3.126.37.18	11048	TCP
2024-12-28T21:07:31.869895+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49741	3.126.37.18	11048	TCP
2024-12-28T21:07:35.721422+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49742	3.126.37.18	11048	TCP
2024-12-28T21:07:41.161965+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49743	3.126.37.18	11048	TCP
2024-12-28T21:07:44.533732+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49744	3.126.37.18	11048	TCP
2024-12-28T21:07:50.148764+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49745	3.126.37.18	11048	TCP
2024-12-28T21:07:53.239659+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49746	3.126.37.18	11048	TCP
2024-12-28T21:07:57.847206+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49749	3.126.37.18	11048	TCP
2024-12-28T21:08:02.113256+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49760	3.126.37.18	11048	TCP
2024-12-28T21:08:06.584971+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49771	3.126.37.18	11048	TCP
2024-12-28T21:08:11.018169+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49782	18.156.13.209	11048	TCP
2024-12-28T21:08:15.359825+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49791	18.156.13.209	11048	TCP
2024-12-28T21:08:19.772250+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49801	18.156.13.209	11048	TCP
2024-12-28T21:08:23.910907+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49812	18.156.13.209	11048	TCP
2024-12-28T21:08:28.058099+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49822	18.156.13.209	11048	TCP
2024-12-28T21:08:32.045707+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49830	18.156.13.209	11048	TCP
2024-12-28T21:08:35.028522+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49838	18.156.13.209	11048	TCP
2024-12-28T21:08:37.998860+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49845	18.156.13.209	11048	TCP
2024-12-28T21:08:40.839556+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49852	18.156.13.209	11048	TCP
2024-12-28T21:08:43.598925+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49860	18.156.13.209	11048	TCP
2024-12-28T21:08:46.406182+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49866	18.156.13.209	11048	TCP
2024-12-28T21:08:48.918294+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49872	18.156.13.209	11048	TCP
2024-12-28T21:08:51.549706+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49878	18.156.13.209	11048	TCP
2024-12-28T21:08:54.250997+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49884	18.156.13.209	11048	TCP
2024-12-28T21:08:56.322390+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49890	18.156.13.209	11048	TCP
2024-12-28T21:08:58.707818+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49896	18.156.13.209	11048	TCP
2024-12-28T21:09:01.031542+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49904	18.156.13.209	11048	TCP
2024-12-28T21:09:03.299990+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49910	18.156.13.209	11048	TCP
2024-12-28T21:09:05.507174+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49914	18.156.13.209	11048	TCP
2024-12-28T21:09:07.571962+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49920	18.156.13.209	11048	TCP
2024-12-28T21:09:09.673016+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49926	18.156.13.209	11048	TCP
2024-12-28T21:09:11.927094+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49932	18.197.239.5	11048	TCP
2024-12-28T21:09:14.069397+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49938	18.197.239.5	11048	TCP
2024-12-28T21:09:16.358429+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49944	18.197.239.5	11048	TCP
2024-12-28T21:09:17.971531+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49950	18.197.239.5	11048	TCP
2024-12-28T21:09:19.853666+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49956	18.197.239.5	11048	TCP
2024-12-28T21:09:21.814418+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49962	18.197.239.5	11048	TCP
2024-12-28T21:09:23.693332+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49964	18.197.239.5	11048	TCP
2024-12-28T21:09:25.681224+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49969	18.197.239.5	11048	TCP
2024-12-28T21:09:27.503838+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49975	18.197.239.5	11048	TCP
2024-12-28T21:09:29.283727+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49981	18.197.239.5	11048	TCP
2024-12-28T21:09:31.160289+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49987	18.197.239.5	11048	TCP
2024-12-28T21:09:33.219478+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49988	18.197.239.5	11048	TCP
2024-12-28T21:09:34.706032+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49994	18.197.239.5	11048	TCP
2024-12-28T21:09:36.494680+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50000	18.197.239.5	11048	TCP
2024-12-28T21:09:38.202245+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50004	18.197.239.5	11048	TCP
2024-12-28T21:09:39.860100+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50007	18.197.239.5	11048	TCP
2024-12-28T21:09:41.610632+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50013	18.197.239.5	11048	TCP
2024-12-28T21:09:43.406959+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50019	18.197.239.5	11048	TCP
2024-12-28T21:09:45.013924+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50024	18.197.239.5	11048	TCP
2024-12-28T21:09:46.712684+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:06.095866+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50057	18.197.239.5	11048	TCP
2024-12-28T21:10:08.756066+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50058	18.197.239.5	11048	TCP
2024-12-28T21:10:11.120478+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50059	18.197.239.5	11048	TCP
2024-12-28T21:10:14.064612+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50060	18.192.93.86	11048	TCP
2024-12-28T21:10:16.496582+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50061	18.192.93.86	11048	TCP
2024-12-28T21:10:18.997271+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50062	18.192.93.86	11048	TCP
2024-12-28T21:10:21.380181+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50063	18.192.93.86	11048	TCP
2024-12-28T21:10:23.833271+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50064	18.192.93.86	11048	TCP
2024-12-28T21:10:26.223684+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50065	18.192.93.86	11048	TCP
2024-12-28T21:10:28.631109+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50066	18.192.93.86	11048	TCP
2024-12-28T21:10:31.670987+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50067	18.192.93.86	11048	TCP
2024-12-28T21:10:33.140094+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50068	18.192.93.86	11048	TCP
2024-12-28T21:10:34.823236+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50069	18.192.93.86	11048	TCP
2024-12-28T21:10:36.299021+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50070	18.192.93.86	11048	TCP
2024-12-28T21:10:38.584287+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50071	18.192.93.86	11048	TCP
2024-12-28T21:10:39.484267+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50072	18.192.93.86	11048	TCP
2024-12-28T21:10:41.410969+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50073	18.192.93.86	11048	TCP
2024-12-28T21:10:42.743875+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50074	18.192.93.86	11048	TCP
2024-12-28T21:10:44.261786+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50075	18.192.93.86	11048	TCP
2024-12-28T21:10:45.886881+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50076	18.192.93.86	11048	TCP
2024-12-28T21:10:47.571861+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50077	18.192.93.86	11048	TCP
2024-12-28T21:10:49.117583+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50078	18.192.93.86	11048	TCP
2024-12-28T21:10:50.688877+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50079	18.192.93.86	11048	TCP
2024-12-28T21:10:52.219293+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50080	18.192.93.86	11048	TCP
2024-12-28T21:10:53.853639+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50081	18.192.93.86	11048	TCP
2024-12-28T21:10:55.420699+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50082	18.192.93.86	11048	TCP
2024-12-28T21:10:56.916319+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50083	18.192.93.86	11048	TCP
2024-12-28T21:10:59.130080+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50084	18.192.93.86	11048	TCP
2024-12-28T21:11:00.627393+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50085	18.192.93.86	11048	TCP

ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T21:07:09.834020+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49730	3.126.37.18	11048	TCP
2024-12-28T21:07:13.943806+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49732	3.126.37.18	11048	TCP
2024-12-28T21:07:18.426111+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49736	3.126.37.18	11048	TCP
2024-12-28T21:07:23.275795+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49739	3.126.37.18	11048	TCP
2024-12-28T21:07:26.936209+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49740	3.126.37.18	11048	TCP
2024-12-28T21:07:31.869895+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49741	3.126.37.18	11048	TCP
2024-12-28T21:07:35.721422+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49742	3.126.37.18	11048	TCP
2024-12-28T21:07:41.161965+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49743	3.126.37.18	11048	TCP
2024-12-28T21:07:44.533732+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49744	3.126.37.18	11048	TCP
2024-12-28T21:07:50.148764+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49745	3.126.37.18	11048	TCP
2024-12-28T21:07:53.239659+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49746	3.126.37.18	11048	TCP
2024-12-28T21:07:57.847206+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49749	3.126.37.18	11048	TCP
2024-12-28T21:08:02.113256+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49760	3.126.37.18	11048	TCP
2024-12-28T21:08:06.584971+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49771	3.126.37.18	11048	TCP
2024-12-28T21:08:11.018169+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49782	18.156.13.209	11048	TCP
2024-12-28T21:08:15.359825+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49791	18.156.13.209	11048	TCP
2024-12-28T21:08:19.772250+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49801	18.156.13.209	11048	TCP
2024-12-28T21:08:23.910907+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49812	18.156.13.209	11048	TCP
2024-12-28T21:08:28.058099+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49822	18.156.13.209	11048	TCP
2024-12-28T21:08:32.045707+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49830	18.156.13.209	11048	TCP
2024-12-28T21:08:35.028522+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49838	18.156.13.209	11048	TCP
2024-12-28T21:08:37.998860+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49845	18.156.13.209	11048	TCP
2024-12-28T21:08:40.839556+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49852	18.156.13.209	11048	TCP
2024-12-28T21:08:43.598925+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49860	18.156.13.209	11048	TCP
2024-12-28T21:08:46.406182+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49866	18.156.13.209	11048	TCP
2024-12-28T21:08:48.918294+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49872	18.156.13.209	11048	TCP
2024-12-28T21:08:51.549706+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49878	18.156.13.209	11048	TCP
2024-12-28T21:08:54.250997+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49884	18.156.13.209	11048	TCP
2024-12-28T21:08:56.322390+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49890	18.156.13.209	11048	TCP
2024-12-28T21:08:58.707818+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49896	18.156.13.209	11048	TCP
2024-12-28T21:09:01.031542+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49904	18.156.13.209	11048	TCP
2024-12-28T21:09:03.299990+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49910	18.156.13.209	11048	TCP
2024-12-28T21:09:05.507174+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49914	18.156.13.209	11048	TCP
2024-12-28T21:09:07.571962+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49920	18.156.13.209	11048	TCP
2024-12-28T21:09:09.673016+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49926	18.156.13.209	11048	TCP
2024-12-28T21:09:11.927094+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49932	18.197.239.5	11048	TCP
2024-12-28T21:09:14.069397+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49938	18.197.239.5	11048	TCP
2024-12-28T21:09:16.358429+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49944	18.197.239.5	11048	TCP
2024-12-28T21:09:17.971531+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49950	18.197.239.5	11048	TCP
2024-12-28T21:09:19.853666+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49956	18.197.239.5	11048	TCP
2024-12-28T21:09:21.814418+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49962	18.197.239.5	11048	TCP
2024-12-28T21:09:23.693332+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49964	18.197.239.5	11048	TCP
2024-12-28T21:09:25.681224+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49969	18.197.239.5	11048	TCP
2024-12-28T21:09:27.503838+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49975	18.197.239.5	11048	TCP
2024-12-28T21:09:29.283727+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49981	18.197.239.5	11048	TCP
2024-12-28T21:09:31.160289+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49987	18.197.239.5	11048	TCP
2024-12-28T21:09:33.219478+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49988	18.197.239.5	11048	TCP
2024-12-28T21:09:34.706032+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49994	18.197.239.5	11048	TCP
2024-12-28T21:09:36.494680+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50000	18.197.239.5	11048	TCP
2024-12-28T21:09:38.202245+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50004	18.197.239.5	11048	TCP
2024-12-28T21:09:39.860100+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50007	18.197.239.5	11048	TCP
2024-12-28T21:09:41.610632+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50013	18.197.239.5	11048	TCP
2024-12-28T21:09:43.406959+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50019	18.197.239.5	11048	TCP
2024-12-28T21:09:45.013924+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50024	18.197.239.5	11048	TCP
2024-12-28T21:09:46.712684+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:06.095866+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50057	18.197.239.5	11048	TCP
2024-12-28T21:10:08.756066+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50058	18.197.239.5	11048	TCP
2024-12-28T21:10:11.120478+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50059	18.197.239.5	11048	TCP
2024-12-28T21:10:14.064612+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50060	18.192.93.86	11048	TCP
2024-12-28T21:10:16.496582+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50061	18.192.93.86	11048	TCP
2024-12-28T21:10:18.997271+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50062	18.192.93.86	11048	TCP
2024-12-28T21:10:21.380181+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50063	18.192.93.86	11048	TCP
2024-12-28T21:10:23.833271+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50064	18.192.93.86	11048	TCP
2024-12-28T21:10:26.223684+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50065	18.192.93.86	11048	TCP
2024-12-28T21:10:28.631109+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50066	18.192.93.86	11048	TCP
2024-12-28T21:10:31.670987+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50067	18.192.93.86	11048	TCP
2024-12-28T21:10:33.140094+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50068	18.192.93.86	11048	TCP
2024-12-28T21:10:34.823236+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50069	18.192.93.86	11048	TCP
2024-12-28T21:10:36.299021+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50070	18.192.93.86	11048	TCP
2024-12-28T21:10:38.584287+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50071	18.192.93.86	11048	TCP
2024-12-28T21:10:39.484267+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50072	18.192.93.86	11048	TCP
2024-12-28T21:10:41.410969+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50073	18.192.93.86	11048	TCP
2024-12-28T21:10:42.743875+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50074	18.192.93.86	11048	TCP
2024-12-28T21:10:44.261786+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50075	18.192.93.86	11048	TCP
2024-12-28T21:10:45.886881+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50076	18.192.93.86	11048	TCP
2024-12-28T21:10:47.571861+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50077	18.192.93.86	11048	TCP
2024-12-28T21:10:49.117583+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50078	18.192.93.86	11048	TCP
2024-12-28T21:10:50.688877+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50079	18.192.93.86	11048	TCP
2024-12-28T21:10:52.219293+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50080	18.192.93.86	11048	TCP
2024-12-28T21:10:53.853639+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50081	18.192.93.86	11048	TCP
2024-12-28T21:10:55.420699+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50082	18.192.93.86	11048	TCP
2024-12-28T21:10:56.916319+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50083	18.192.93.86	11048	TCP
2024-12-28T21:10:59.130080+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50084	18.192.93.86	11048	TCP
2024-12-28T21:11:00.627393+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50085	18.192.93.86	11048	TCP

ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T21:07:15.603959+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49732	3.126.37.18	11048	TCP
2024-12-28T21:07:24.114969+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49739	3.126.37.18	11048	TCP
2024-12-28T21:07:32.429888+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49741	3.126.37.18	11048	TCP
2024-12-28T21:07:53.806095+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49746	3.126.37.18	11048	TCP
2024-12-28T21:07:58.087104+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49749	3.126.37.18	11048	TCP
2024-12-28T21:08:03.634253+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49760	3.126.37.18	11048	TCP
2024-12-28T21:08:07.103079+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49771	3.126.37.18	11048	TCP
2024-12-28T21:08:08.212650+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49771	3.126.37.18	11048	TCP
2024-12-28T21:08:11.681647+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49782	18.156.13.209	11048	TCP
2024-12-28T21:08:11.884168+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49782	18.156.13.209	11048	TCP
2024-12-28T21:08:12.932806+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49782	18.156.13.209	11048	TCP
2024-12-28T21:08:13.055838+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49782	18.156.13.209	11048	TCP
2024-12-28T21:08:16.207498+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49791	18.156.13.209	11048	TCP
2024-12-28T21:08:16.568653+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49791	18.156.13.209	11048	TCP
2024-12-28T21:08:16.928578+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49791	18.156.13.209	11048	TCP
2024-12-28T21:08:17.048085+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49791	18.156.13.209	11048	TCP
2024-12-28T21:08:20.013223+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49801	18.156.13.209	11048	TCP
2024-12-28T21:08:20.707341+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49801	18.156.13.209	11048	TCP
2024-12-28T21:08:21.425315+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49801	18.156.13.209	11048	TCP
2024-12-28T21:08:21.665378+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49801	18.156.13.209	11048	TCP
2024-12-28T21:08:21.786368+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49801	18.156.13.209	11048	TCP
2024-12-28T21:08:25.111577+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49812	18.156.13.209	11048	TCP
2024-12-28T21:08:25.955716+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49812	18.156.13.209	11048	TCP
2024-12-28T21:08:28.905509+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49822	18.156.13.209	11048	TCP
2024-12-28T21:08:29.624450+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49822	18.156.13.209	11048	TCP
2024-12-28T21:08:29.770800+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49822	18.156.13.209	11048	TCP
2024-12-28T21:08:29.891210+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49822	18.156.13.209	11048	TCP
2024-12-28T21:08:32.287230+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49830	18.156.13.209	11048	TCP
2024-12-28T21:08:35.509277+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49838	18.156.13.209	11048	TCP
2024-12-28T21:08:36.175638+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49838	18.156.13.209	11048	TCP
2024-12-28T21:08:36.295111+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49838	18.156.13.209	11048	TCP
2024-12-28T21:08:38.477257+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49845	18.156.13.209	11048	TCP
2024-12-28T21:08:38.596799+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49845	18.156.13.209	11048	TCP
2024-12-28T21:08:44.202928+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49860	18.156.13.209	11048	TCP
2024-12-28T21:08:44.325681+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49860	18.156.13.209	11048	TCP
2024-12-28T21:08:47.005551+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49866	18.156.13.209	11048	TCP
2024-12-28T21:08:47.380745+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49866	18.156.13.209	11048	TCP
2024-12-28T21:08:47.620176+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49866	18.156.13.209	11048	TCP
2024-12-28T21:08:49.521250+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49872	18.156.13.209	11048	TCP
2024-12-28T21:08:49.640949+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49872	18.156.13.209	11048	TCP
2024-12-28T21:08:49.880029+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49872	18.156.13.209	11048	TCP
2024-12-28T21:08:51.908721+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49878	18.156.13.209	11048	TCP
2024-12-28T21:08:52.028524+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49878	18.156.13.209	11048	TCP
2024-12-28T21:08:52.509325+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49878	18.156.13.209	11048	TCP
2024-12-28T21:08:54.563181+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49884	18.156.13.209	11048	TCP
2024-12-28T21:08:56.921621+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49890	18.156.13.209	11048	TCP
2024-12-28T21:08:57.300084+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49890	18.156.13.209	11048	TCP
2024-12-28T21:08:59.187453+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49896	18.156.13.209	11048	TCP
2024-12-28T21:08:59.671278+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49896	18.156.13.209	11048	TCP
2024-12-28T21:08:59.792463+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49896	18.156.13.209	11048	TCP
2024-12-28T21:09:01.872596+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49904	18.156.13.209	11048	TCP
2024-12-28T21:09:02.236921+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49904	18.156.13.209	11048	TCP
2024-12-28T21:09:02.357861+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49904	18.156.13.209	11048	TCP
2024-12-28T21:09:03.902169+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49910	18.156.13.209	11048	TCP
2024-12-28T21:09:04.270455+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49910	18.156.13.209	11048	TCP
2024-12-28T21:09:06.228876+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49914	18.156.13.209	11048	TCP
2024-12-28T21:09:06.355666+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49914	18.156.13.209	11048	TCP
2024-12-28T21:09:06.715549+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49914	18.156.13.209	11048	TCP
2024-12-28T21:09:07.936078+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49920	18.156.13.209	11048	TCP
2024-12-28T21:09:08.416824+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49920	18.156.13.209	11048	TCP
2024-12-28T21:09:10.272292+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49926	18.156.13.209	11048	TCP
2024-12-28T21:09:10.392131+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49926	18.156.13.209	11048	TCP
2024-12-28T21:09:10.511739+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49926	18.156.13.209	11048	TCP
2024-12-28T21:09:12.285846+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49932	18.197.239.5	11048	TCP
2024-12-28T21:09:12.411414+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49932	18.197.239.5	11048	TCP
2024-12-28T21:09:12.898340+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49932	18.197.239.5	11048	TCP
2024-12-28T21:09:14.308836+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49938	18.197.239.5	11048	TCP
2024-12-28T21:09:14.428684+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49938	18.197.239.5	11048	TCP
2024-12-28T21:09:14.917344+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49938	18.197.239.5	11048	TCP
2024-12-28T21:09:16.597798+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49944	18.197.239.5	11048	TCP
2024-12-28T21:09:16.717383+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49944	18.197.239.5	11048	TCP
2024-12-28T21:09:16.836877+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49944	18.197.239.5	11048	TCP
2024-12-28T21:09:18.331182+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49950	18.197.239.5	11048	TCP
2024-12-28T21:09:19.105678+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49950	18.197.239.5	11048	TCP
2024-12-28T21:09:20.267033+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49956	18.197.239.5	11048	TCP
2024-12-28T21:09:22.055226+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49962	18.197.239.5	11048	TCP
2024-12-28T21:09:22.534297+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49962	18.197.239.5	11048	TCP
2024-12-28T21:09:22.897972+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49962	18.197.239.5	11048	TCP
2024-12-28T21:09:23.017539+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49962	18.197.239.5	11048	TCP
2024-12-28T21:09:24.175142+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49964	18.197.239.5	11048	TCP
2024-12-28T21:09:26.159736+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49969	18.197.239.5	11048	TCP
2024-12-28T21:09:26.279329+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49969	18.197.239.5	11048	TCP
2024-12-28T21:09:26.399129+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49969	18.197.239.5	11048	TCP
2024-12-28T21:09:26.667738+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49969	18.197.239.5	11048	TCP
2024-12-28T21:09:27.862494+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49975	18.197.239.5	11048	TCP
2024-12-28T21:09:28.460753+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49975	18.197.239.5	11048	TCP
2024-12-28T21:09:30.005351+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49981	18.197.239.5	11048	TCP
2024-12-28T21:09:30.211236+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49981	18.197.239.5	11048	TCP
2024-12-28T21:09:30.330785+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49981	18.197.239.5	11048	TCP
2024-12-28T21:09:30.450264+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49981	18.197.239.5	11048	TCP
2024-12-28T21:09:30.569831+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49981	18.197.239.5	11048	TCP
2024-12-28T21:09:32.125104+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49987	18.197.239.5	11048	TCP
2024-12-28T21:09:32.244676+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49987	18.197.239.5	11048	TCP
2024-12-28T21:09:32.365373+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49987	18.197.239.5	11048	TCP
2024-12-28T21:09:35.193578+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49994	18.197.239.5	11048	TCP
2024-12-28T21:09:35.920593+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49994	18.197.239.5	11048	TCP
2024-12-28T21:09:36.734534+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50000	18.197.239.5	11048	TCP
2024-12-28T21:09:36.858310+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50000	18.197.239.5	11048	TCP
2024-12-28T21:09:36.981380+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50000	18.197.239.5	11048	TCP
2024-12-28T21:09:38.686317+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50004	18.197.239.5	11048	TCP
2024-12-28T21:09:39.050810+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50004	18.197.239.5	11048	TCP
2024-12-28T21:09:39.295408+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50004	18.197.239.5	11048	TCP
2024-12-28T21:09:40.817693+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50007	18.197.239.5	11048	TCP
2024-12-28T21:09:40.937655+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50007	18.197.239.5	11048	TCP
2024-12-28T21:09:41.969975+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50013	18.197.239.5	11048	TCP
2024-12-28T21:09:42.089653+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50013	18.197.239.5	11048	TCP
2024-12-28T21:09:42.209268+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50013	18.197.239.5	11048	TCP
2024-12-28T21:09:42.695216+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50013	18.197.239.5	11048	TCP
2024-12-28T21:09:42.814871+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50013	18.197.239.5	11048	TCP
2024-12-28T21:09:43.886408+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50019	18.197.239.5	11048	TCP
2024-12-28T21:09:44.613164+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50019	18.197.239.5	11048	TCP
2024-12-28T21:09:45.406194+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50024	18.197.239.5	11048	TCP
2024-12-28T21:09:46.125420+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50024	18.197.239.5	11048	TCP
2024-12-28T21:09:46.246397+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50024	18.197.239.5	11048	TCP
2024-12-28T21:09:47.075090+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:47.317390+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:47.437530+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:47.583008+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:47.703346+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:47.942538+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:48.062305+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:48.301594+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:49.147100+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:49.267020+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:50.110802+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:50.470393+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:51.203388+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:51.686326+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:51.806102+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:51.926208+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:53.011392+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:53.131039+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:53.734417+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:54.213578+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:54.334099+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:55.055065+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:55.536412+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:56.255059+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:56.980261+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:57.100346+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:57.721026+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:58.429656+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:58.622326+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:59.186210+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:59.306013+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:00.468305+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:00.711453+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:01.071426+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:01.467691+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:01.589596+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:02.114700+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:02.473999+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:02.593572+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:02.713461+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:03.799484+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:04.158654+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:04.278578+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:04.775310+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:05.290917+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:05.530273+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:05.771139+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:06.925354+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50057	18.197.239.5	11048	TCP
2024-12-28T21:10:07.166015+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50057	18.197.239.5	11048	TCP
2024-12-28T21:10:08.124154+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50057	18.197.239.5	11048	TCP
2024-12-28T21:10:08.997467+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50058	18.197.239.5	11048	TCP
2024-12-28T21:10:09.599442+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50058	18.197.239.5	11048	TCP
2024-12-28T21:10:09.720503+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50058	18.197.239.5	11048	TCP
2024-12-28T21:10:11.599504+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50059	18.197.239.5	11048	TCP
2024-12-28T21:10:11.839087+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50059	18.197.239.5	11048	TCP
2024-12-28T21:10:14.543337+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50060	18.192.93.86	11048	TCP
2024-12-28T21:10:14.663981+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50060	18.192.93.86	11048	TCP
2024-12-28T21:10:15.534161+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50060	18.192.93.86	11048	TCP
2024-12-28T21:10:15.657604+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50060	18.192.93.86	11048	TCP
2024-12-28T21:10:15.777339+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50060	18.192.93.86	11048	TCP
2024-12-28T21:10:15.897119+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50060	18.192.93.86	11048	TCP
2024-12-28T21:10:16.016897+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50060	18.192.93.86	11048	TCP
2024-12-28T21:10:16.337427+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50060	18.192.93.86	11048	TCP
2024-12-28T21:10:16.736216+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50061	18.192.93.86	11048	TCP
2024-12-28T21:10:17.575856+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50061	18.192.93.86	11048	TCP
2024-12-28T21:10:17.819595+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50061	18.192.93.86	11048	TCP
2024-12-28T21:10:18.429989+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50061	18.192.93.86	11048	TCP
2024-12-28T21:10:18.670665+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50061	18.192.93.86	11048	TCP
2024-12-28T21:10:19.237340+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50062	18.192.93.86	11048	TCP
2024-12-28T21:10:19.411149+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50062	18.192.93.86	11048	TCP
2024-12-28T21:10:19.651051+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50062	18.192.93.86	11048	TCP
2024-12-28T21:10:20.499418+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50062	18.192.93.86	11048	TCP
2024-12-28T21:10:20.739213+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50062	18.192.93.86	11048	TCP
2024-12-28T21:10:21.740019+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50063	18.192.93.86	11048	TCP
2024-12-28T21:10:21.860800+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50063	18.192.93.86	11048	TCP
2024-12-28T21:10:22.460034+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50063	18.192.93.86	11048	TCP
2024-12-28T21:10:23.061398+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50063	18.192.93.86	11048	TCP
2024-12-28T21:10:23.181078+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50063	18.192.93.86	11048	TCP
2024-12-28T21:10:24.314601+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50064	18.192.93.86	11048	TCP
2024-12-28T21:10:24.434308+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50064	18.192.93.86	11048	TCP
2024-12-28T21:10:24.554394+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50064	18.192.93.86	11048	TCP
2024-12-28T21:10:24.674294+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50064	18.192.93.86	11048	TCP
2024-12-28T21:10:25.339329+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50064	18.192.93.86	11048	TCP
2024-12-28T21:10:25.459232+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50064	18.192.93.86	11048	TCP
2024-12-28T21:10:26.584655+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50065	18.192.93.86	11048	TCP
2024-12-28T21:10:27.422949+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50065	18.192.93.86	11048	TCP
2024-12-28T21:10:28.068402+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50065	18.192.93.86	11048	TCP
2024-12-28T21:10:28.462435+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50065	18.192.93.86	11048	TCP
2024-12-28T21:10:28.993546+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50066	18.192.93.86	11048	TCP
2024-12-28T21:10:29.357696+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50066	18.192.93.86	11048	TCP
2024-12-28T21:10:29.961956+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50066	18.192.93.86	11048	TCP
2024-12-28T21:10:30.201409+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50066	18.192.93.86	11048	TCP
2024-12-28T21:10:30.321097+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50066	18.192.93.86	11048	TCP
2024-12-28T21:10:30.440952+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50066	18.192.93.86	11048	TCP
2024-12-28T21:10:30.681864+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50066	18.192.93.86	11048	TCP
2024-12-28T21:10:31.041125+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50066	18.192.93.86	11048	TCP
2024-12-28T21:10:32.030660+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50067	18.192.93.86	11048	TCP
2024-12-28T21:10:32.150303+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50067	18.192.93.86	11048	TCP
2024-12-28T21:10:32.270026+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50067	18.192.93.86	11048	TCP
2024-12-28T21:10:33.859043+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50068	18.192.93.86	11048	TCP
2024-12-28T21:10:34.101657+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50068	18.192.93.86	11048	TCP
2024-12-28T21:10:34.571942+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50068	18.192.93.86	11048	TCP
2024-12-28T21:10:35.688276+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50069	18.192.93.86	11048	TCP
2024-12-28T21:10:36.047718+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50069	18.192.93.86	11048	TCP
2024-12-28T21:10:36.897472+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50070	18.192.93.86	11048	TCP
2024-12-28T21:10:37.377933+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50070	18.192.93.86	11048	TCP
2024-12-28T21:10:37.499513+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50070	18.192.93.86	11048	TCP
2024-12-28T21:10:37.728308+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50070	18.192.93.86	11048	TCP
2024-12-28T21:10:38.946871+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50071	18.192.93.86	11048	TCP
2024-12-28T21:10:39.186402+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50071	18.192.93.86	11048	TCP
2024-12-28T21:10:39.723671+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50072	18.192.93.86	11048	TCP
2024-12-28T21:10:40.133648+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50072	18.192.93.86	11048	TCP
2024-12-28T21:10:42.011326+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50073	18.192.93.86	11048	TCP
2024-12-28T21:10:42.131009+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50073	18.192.93.86	11048	TCP
2024-12-28T21:10:42.258183+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50073	18.192.93.86	11048	TCP
2024-12-28T21:10:43.707504+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50074	18.192.93.86	11048	TCP
2024-12-28T21:10:43.827276+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50074	18.192.93.86	11048	TCP
2024-12-28T21:10:44.087777+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50074	18.192.93.86	11048	TCP
2024-12-28T21:10:44.980968+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50075	18.192.93.86	11048	TCP
2024-12-28T21:10:45.101033+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50075	18.192.93.86	11048	TCP
2024-12-28T21:10:45.220873+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50075	18.192.93.86	11048	TCP
2024-12-28T21:10:45.713849+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50075	18.192.93.86	11048	TCP
2024-12-28T21:10:46.126719+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50076	18.192.93.86	11048	TCP
2024-12-28T21:10:46.486238+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50076	18.192.93.86	11048	TCP
2024-12-28T21:10:46.606222+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50076	18.192.93.86	11048	TCP
2024-12-28T21:10:46.726025+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50076	18.192.93.86	11048	TCP
2024-12-28T21:10:46.965466+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50076	18.192.93.86	11048	TCP
2024-12-28T21:10:47.085183+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50076	18.192.93.86	11048	TCP
2024-12-28T21:10:47.934477+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50077	18.192.93.86	11048	TCP
2024-12-28T21:10:48.054534+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50077	18.192.93.86	11048	TCP
2024-12-28T21:10:48.295388+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50077	18.192.93.86	11048	TCP
2024-12-28T21:10:48.415403+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50077	18.192.93.86	11048	TCP
2024-12-28T21:10:48.896245+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50077	18.192.93.86	11048	TCP
2024-12-28T21:10:48.946753+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50077	18.192.93.86	11048	TCP
2024-12-28T21:10:49.483251+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50078	18.192.93.86	11048	TCP
2024-12-28T21:10:49.602829+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50078	18.192.93.86	11048	TCP
2024-12-28T21:10:49.963316+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50078	18.192.93.86	11048	TCP
2024-12-28T21:10:50.082970+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50078	18.192.93.86	11048	TCP
2024-12-28T21:10:50.202774+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50078	18.192.93.86	11048	TCP
2024-12-28T21:10:50.442243+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50078	18.192.93.86	11048	TCP
2024-12-28T21:10:51.048828+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50079	18.192.93.86	11048	TCP
2024-12-28T21:10:51.409456+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50079	18.192.93.86	11048	TCP
2024-12-28T21:10:51.531554+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50079	18.192.93.86	11048	TCP
2024-12-28T21:10:52.012453+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50079	18.192.93.86	11048	TCP
2024-12-28T21:10:52.947499+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50080	18.192.93.86	11048	TCP
2024-12-28T21:10:53.067079+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50080	18.192.93.86	11048	TCP
2024-12-28T21:10:54.332182+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50081	18.192.93.86	11048	TCP
2024-12-28T21:10:54.451749+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50081	18.192.93.86	11048	TCP
2024-12-28T21:10:55.228017+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50081	18.192.93.86	11048	TCP
2024-12-28T21:10:55.781409+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50082	18.192.93.86	11048	TCP
2024-12-28T21:10:55.900986+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50082	18.192.93.86	11048	TCP
2024-12-28T21:10:56.642520+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50082	18.192.93.86	11048	TCP
2024-12-28T21:10:56.744002+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50082	18.192.93.86	11048	TCP
2024-12-28T21:10:59.369650+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50084	18.192.93.86	11048	TCP
2024-12-28T21:10:59.608928+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50084	18.192.93.86	11048	TCP
2024-12-28T21:11:00.869659+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50085	18.192.93.86	11048	TCP
2024-12-28T21:11:00.989854+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50085	18.192.93.86	11048	TCP
2024-12-28T21:11:01.261652+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50085	18.192.93.86	11048	TCP

ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T21:07:09.953895+0100	2825563	1	Malware Command and Control Activity Detected	192.168.2.4	49730	3.126.37.18	11048	TCP
2024-12-28T21:07:14.063413+0100	2825563	1	Malware Command and Control Activity Detected	192.168.2.4	49732	3.126.37.18	11048	TCP
2024-12-28T21:07:18.545663+0100	2825563	1	Malware Command and Control Activity Detected	192.168.2.4	49736	3.126.37.18	11048	TCP
2024-12-28T21:07:23.395539+0100	2825563	1	Malware Command and Control Activity Detected	192.168.2.4	49739	3.126.37.18	11048	TCP
2024-12-28T21:07:27.055994+0100	2825563	1	Malware Command and Control Activity Detected	192.168.2.4	49740	3.126.37.18	11048	TCP
2024-12-28T21:07:31.989706+0100	2825563	1	Malware Command and Control Activity Detected	192.168.2.4	49741	3.126.37.18	11048	TCP
2024-12-28T21:07:35.841117+0100	2825563	1	Malware Command and Control Activity Detected	192.168.2.4	49742	3.126.37.18	11048	TCP
2024-12-28T21:07:44.653576+0100	2825563	1	Malware Command and Control Activity Detected	192.168.2.4	49744	3.126.37.18	11048	TCP
2024-12-28T21:07:50.268538+0100	2825563	1	Malware Command and Control Activity Detected	192.168.2.4	49745	3.126.37.18	11048	TCP
2024-12-28T21:07:53.359614+0100	2825563	1	Malware Command and Control Activity Detected	192.168.2.4	49746	3.126.37.18	11048	TCP
2024-12-28T21:07:57.967015+0100	2825563	1	Malware Command and Control Activity Detected	192.168.2.4	49749	3.126.37.18	11048	TCP
2024-12-28T21:08:02.233313+0100	2825563	1	Malware Command and Control Activity Detected	192.168.2.4	49760	3.126.37.18	11048	TCP
2024-12-28T21:08:06.704875+0100	2825563	1	Malware Command and Control Activity Detected	192.168.2.4	49771	3.126.37.18	11048	TCP

ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50068	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50063	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50067	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49838	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50071	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50061	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49736	3.126.37.18	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49884	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50072	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49896	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49910	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50080	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49890	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49920	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49926	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50076	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49743	3.126.37.18	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49749	3.126.37.18	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49950	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50084	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49741	3.126.37.18	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49782	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50013	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50065	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49938	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50058	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49932	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50082	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49969	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49866	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49981	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50057	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49744	3.126.37.18	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49739	3.126.37.18	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49845	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49872	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50074	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50079	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49988	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49987	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49956	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50024	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49760	3.126.37.18	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50083	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49730	3.126.37.18	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49975	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50059	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49852	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49904	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49878	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49964	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49740	3.126.37.18	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49745	3.126.37.18	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50007	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50000	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49830	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49801	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50077	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50085	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50004	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49746	3.126.37.18	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50078	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50070	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50060	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50019	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49771	3.126.37.18	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50064	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50066	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49962	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49860	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50062	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49732	3.126.37.18	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49914	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50081	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50073	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50075	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50069	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49944	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49742	3.126.37.18	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49994	18.197.239.5	11048	TCP
2024-12-28T21:07:09.834020+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49730	3.126.37.18	11048	TCP
2024-12-28T21:07:13.943806+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49732	3.126.37.18	11048	TCP
2024-12-28T21:07:18.426111+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49736	3.126.37.18	11048	TCP
2024-12-28T21:07:23.275795+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49739	3.126.37.18	11048	TCP
2024-12-28T21:07:26.936209+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49740	3.126.37.18	11048	TCP
2024-12-28T21:07:31.869895+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49741	3.126.37.18	11048	TCP
2024-12-28T21:07:35.721422+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49742	3.126.37.18	11048	TCP
2024-12-28T21:07:41.161965+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49743	3.126.37.18	11048	TCP
2024-12-28T21:07:44.533732+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49744	3.126.37.18	11048	TCP
2024-12-28T21:07:50.148764+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49745	3.126.37.18	11048	TCP
2024-12-28T21:07:53.239659+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49746	3.126.37.18	11048	TCP
2024-12-28T21:07:57.847206+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49749	3.126.37.18	11048	TCP
2024-12-28T21:08:02.113256+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49760	3.126.37.18	11048	TCP
2024-12-28T21:08:06.584971+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49771	3.126.37.18	11048	TCP
2024-12-28T21:08:11.018169+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49782	18.156.13.209	11048	TCP
2024-12-28T21:08:15.359825+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49791	18.156.13.209	11048	TCP
2024-12-28T21:08:17.491259+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49791	18.156.13.209	11048	TCP
2024-12-28T21:08:19.772250+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49801	18.156.13.209	11048	TCP
2024-12-28T21:08:23.910907+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49812	18.156.13.209	11048	TCP
2024-12-28T21:08:25.355251+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49812	18.156.13.209	11048	TCP
2024-12-28T21:08:28.058099+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49822	18.156.13.209	11048	TCP
2024-12-28T21:08:29.891210+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49822	18.156.13.209	11048	TCP
2024-12-28T21:08:32.045707+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49830	18.156.13.209	11048	TCP
2024-12-28T21:08:35.028522+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49838	18.156.13.209	11048	TCP
2024-12-28T21:08:37.998860+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49845	18.156.13.209	11048	TCP
2024-12-28T21:08:40.839556+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49852	18.156.13.209	11048	TCP
2024-12-28T21:08:43.598925+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49860	18.156.13.209	11048	TCP
2024-12-28T21:08:46.406182+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49866	18.156.13.209	11048	TCP
2024-12-28T21:08:48.918294+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49872	18.156.13.209	11048	TCP
2024-12-28T21:08:51.549706+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49878	18.156.13.209	11048	TCP
2024-12-28T21:08:54.250997+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49884	18.156.13.209	11048	TCP
2024-12-28T21:08:56.322390+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49890	18.156.13.209	11048	TCP
2024-12-28T21:08:58.707818+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49896	18.156.13.209	11048	TCP
2024-12-28T21:09:01.031542+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49904	18.156.13.209	11048	TCP
2024-12-28T21:09:03.299990+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49910	18.156.13.209	11048	TCP
2024-12-28T21:09:05.507174+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49914	18.156.13.209	11048	TCP
2024-12-28T21:09:07.571962+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49920	18.156.13.209	11048	TCP
2024-12-28T21:09:09.673016+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49926	18.156.13.209	11048	TCP
2024-12-28T21:09:11.927094+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49932	18.197.239.5	11048	TCP
2024-12-28T21:09:14.069397+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49938	18.197.239.5	11048	TCP
2024-12-28T21:09:16.358429+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49944	18.197.239.5	11048	TCP
2024-12-28T21:09:17.971531+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49950	18.197.239.5	11048	TCP
2024-12-28T21:09:19.853666+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49956	18.197.239.5	11048	TCP
2024-12-28T21:09:21.814418+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49962	18.197.239.5	11048	TCP
2024-12-28T21:09:23.693332+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49964	18.197.239.5	11048	TCP
2024-12-28T21:09:25.681224+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49969	18.197.239.5	11048	TCP
2024-12-28T21:09:27.503838+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49975	18.197.239.5	11048	TCP
2024-12-28T21:09:29.283727+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49981	18.197.239.5	11048	TCP
2024-12-28T21:09:31.160289+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49987	18.197.239.5	11048	TCP
2024-12-28T21:09:33.219478+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49988	18.197.239.5	11048	TCP
2024-12-28T21:09:34.706032+0100	2815696	1	A Network Trojan was detected	192.168.2.4	49994	18.197.239.5	11048	TCP
2024-12-28T21:09:36.494680+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50000	18.197.239.5	11048	TCP
2024-12-28T21:09:38.202245+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50004	18.197.239.5	11048	TCP
2024-12-28T21:09:39.860100+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50007	18.197.239.5	11048	TCP
2024-12-28T21:09:41.610632+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50013	18.197.239.5	11048	TCP
2024-12-28T21:09:43.406959+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50019	18.197.239.5	11048	TCP
2024-12-28T21:09:45.013924+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50024	18.197.239.5	11048	TCP
2024-12-28T21:09:46.712684+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:49.631542+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:06.095866+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50057	18.197.239.5	11048	TCP
2024-12-28T21:10:08.756066+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50058	18.197.239.5	11048	TCP
2024-12-28T21:10:11.120478+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50059	18.197.239.5	11048	TCP
2024-12-28T21:10:14.064612+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50060	18.192.93.86	11048	TCP
2024-12-28T21:10:16.496582+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50061	18.192.93.86	11048	TCP
2024-12-28T21:10:18.997271+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50062	18.192.93.86	11048	TCP
2024-12-28T21:10:21.380181+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50063	18.192.93.86	11048	TCP
2024-12-28T21:10:23.833271+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50064	18.192.93.86	11048	TCP
2024-12-28T21:10:26.223684+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50065	18.192.93.86	11048	TCP
2024-12-28T21:10:28.631109+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50066	18.192.93.86	11048	TCP
2024-12-28T21:10:31.670987+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50067	18.192.93.86	11048	TCP
2024-12-28T21:10:33.140094+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50068	18.192.93.86	11048	TCP
2024-12-28T21:10:34.823236+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50069	18.192.93.86	11048	TCP
2024-12-28T21:10:36.299021+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50070	18.192.93.86	11048	TCP
2024-12-28T21:10:38.584287+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50071	18.192.93.86	11048	TCP
2024-12-28T21:10:39.484267+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50072	18.192.93.86	11048	TCP
2024-12-28T21:10:41.410969+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50073	18.192.93.86	11048	TCP
2024-12-28T21:10:42.743875+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50074	18.192.93.86	11048	TCP
2024-12-28T21:10:44.261786+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50075	18.192.93.86	11048	TCP
2024-12-28T21:10:45.886881+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50076	18.192.93.86	11048	TCP
2024-12-28T21:10:47.571861+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50077	18.192.93.86	11048	TCP
2024-12-28T21:10:49.117583+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50078	18.192.93.86	11048	TCP
2024-12-28T21:10:50.688877+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50079	18.192.93.86	11048	TCP
2024-12-28T21:10:52.219293+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50080	18.192.93.86	11048	TCP
2024-12-28T21:10:53.853639+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50081	18.192.93.86	11048	TCP
2024-12-28T21:10:55.420699+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50082	18.192.93.86	11048	TCP
2024-12-28T21:10:56.916319+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50083	18.192.93.86	11048	TCP
2024-12-28T21:10:59.130080+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50084	18.192.93.86	11048	TCP
2024-12-28T21:11:00.627393+0100	2815696	1	A Network Trojan was detected	192.168.2.4	50085	18.192.93.86	11048	TCP

ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T21:07:09.953895+0100	2838486	1	Malware Command and Control Activity Detected	192.168.2.4	49730	3.126.37.18	11048	TCP
2024-12-28T21:07:14.063413+0100	2838486	1	Malware Command and Control Activity Detected	192.168.2.4	49732	3.126.37.18	11048	TCP
2024-12-28T21:07:18.545663+0100	2838486	1	Malware Command and Control Activity Detected	192.168.2.4	49736	3.126.37.18	11048	TCP
2024-12-28T21:07:23.395539+0100	2838486	1	Malware Command and Control Activity Detected	192.168.2.4	49739	3.126.37.18	11048	TCP
2024-12-28T21:07:27.055994+0100	2838486	1	Malware Command and Control Activity Detected	192.168.2.4	49740	3.126.37.18	11048	TCP
2024-12-28T21:07:31.989706+0100	2838486	1	Malware Command and Control Activity Detected	192.168.2.4	49741	3.126.37.18	11048	TCP
2024-12-28T21:07:35.841117+0100	2838486	1	Malware Command and Control Activity Detected	192.168.2.4	49742	3.126.37.18	11048	TCP
2024-12-28T21:07:44.653576+0100	2838486	1	Malware Command and Control Activity Detected	192.168.2.4	49744	3.126.37.18	11048	TCP
2024-12-28T21:07:50.268538+0100	2838486	1	Malware Command and Control Activity Detected	192.168.2.4	49745	3.126.37.18	11048	TCP
2024-12-28T21:07:53.359614+0100	2838486	1	Malware Command and Control Activity Detected	192.168.2.4	49746	3.126.37.18	11048	TCP
2024-12-28T21:07:57.967015+0100	2838486	1	Malware Command and Control Activity Detected	192.168.2.4	49749	3.126.37.18	11048	TCP
2024-12-28T21:08:02.233313+0100	2838486	1	Malware Command and Control Activity Detected	192.168.2.4	49760	3.126.37.18	11048	TCP
2024-12-28T21:08:06.704875+0100	2838486	1	Malware Command and Control Activity Detected	192.168.2.4	49771	3.126.37.18	11048	TCP

ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T21:07:09.834020+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49730	3.126.37.18	11048	TCP
2024-12-28T21:07:13.943806+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49732	3.126.37.18	11048	TCP
2024-12-28T21:07:18.426111+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49736	3.126.37.18	11048	TCP
2024-12-28T21:07:23.275795+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49739	3.126.37.18	11048	TCP
2024-12-28T21:07:26.936209+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49740	3.126.37.18	11048	TCP
2024-12-28T21:07:31.869895+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49741	3.126.37.18	11048	TCP
2024-12-28T21:07:35.721422+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49742	3.126.37.18	11048	TCP
2024-12-28T21:07:41.161965+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49743	3.126.37.18	11048	TCP
2024-12-28T21:07:44.533732+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49744	3.126.37.18	11048	TCP
2024-12-28T21:07:50.148764+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49745	3.126.37.18	11048	TCP
2024-12-28T21:07:53.239659+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49746	3.126.37.18	11048	TCP
2024-12-28T21:07:57.847206+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49749	3.126.37.18	11048	TCP
2024-12-28T21:08:02.113256+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49760	3.126.37.18	11048	TCP
2024-12-28T21:08:06.584971+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49771	3.126.37.18	11048	TCP
2024-12-28T21:08:11.018169+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49782	18.156.13.209	11048	TCP
2024-12-28T21:08:15.359825+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49791	18.156.13.209	11048	TCP
2024-12-28T21:08:19.772250+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49801	18.156.13.209	11048	TCP
2024-12-28T21:08:23.910907+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49812	18.156.13.209	11048	TCP
2024-12-28T21:08:28.058099+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49822	18.156.13.209	11048	TCP
2024-12-28T21:08:32.045707+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49830	18.156.13.209	11048	TCP
2024-12-28T21:08:35.028522+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49838	18.156.13.209	11048	TCP
2024-12-28T21:08:37.998860+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49845	18.156.13.209	11048	TCP
2024-12-28T21:08:40.839556+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49852	18.156.13.209	11048	TCP
2024-12-28T21:08:43.598925+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49860	18.156.13.209	11048	TCP
2024-12-28T21:08:46.406182+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49866	18.156.13.209	11048	TCP
2024-12-28T21:08:48.918294+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49872	18.156.13.209	11048	TCP
2024-12-28T21:08:51.549706+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49878	18.156.13.209	11048	TCP
2024-12-28T21:08:54.250997+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49884	18.156.13.209	11048	TCP
2024-12-28T21:08:56.322390+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49890	18.156.13.209	11048	TCP
2024-12-28T21:08:58.707818+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49896	18.156.13.209	11048	TCP
2024-12-28T21:09:01.031542+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49904	18.156.13.209	11048	TCP
2024-12-28T21:09:03.299990+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49910	18.156.13.209	11048	TCP
2024-12-28T21:09:05.507174+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49914	18.156.13.209	11048	TCP
2024-12-28T21:09:07.571962+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49920	18.156.13.209	11048	TCP
2024-12-28T21:09:09.673016+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49926	18.156.13.209	11048	TCP
2024-12-28T21:09:11.927094+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49932	18.197.239.5	11048	TCP
2024-12-28T21:09:14.069397+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49938	18.197.239.5	11048	TCP
2024-12-28T21:09:16.358429+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49944	18.197.239.5	11048	TCP
2024-12-28T21:09:17.971531+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49950	18.197.239.5	11048	TCP
2024-12-28T21:09:19.853666+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49956	18.197.239.5	11048	TCP
2024-12-28T21:09:21.814418+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49962	18.197.239.5	11048	TCP
2024-12-28T21:09:23.693332+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49964	18.197.239.5	11048	TCP
2024-12-28T21:09:25.681224+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49969	18.197.239.5	11048	TCP
2024-12-28T21:09:27.503838+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49975	18.197.239.5	11048	TCP
2024-12-28T21:09:29.283727+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49981	18.197.239.5	11048	TCP
2024-12-28T21:09:31.160289+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49987	18.197.239.5	11048	TCP
2024-12-28T21:09:33.219478+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49988	18.197.239.5	11048	TCP
2024-12-28T21:09:34.706032+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	49994	18.197.239.5	11048	TCP
2024-12-28T21:09:36.494680+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50000	18.197.239.5	11048	TCP
2024-12-28T21:09:38.202245+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50004	18.197.239.5	11048	TCP
2024-12-28T21:09:39.860100+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50007	18.197.239.5	11048	TCP
2024-12-28T21:09:41.610632+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50013	18.197.239.5	11048	TCP
2024-12-28T21:09:43.406959+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50019	18.197.239.5	11048	TCP
2024-12-28T21:09:45.013924+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50024	18.197.239.5	11048	TCP
2024-12-28T21:09:46.712684+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:06.095866+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50057	18.197.239.5	11048	TCP
2024-12-28T21:10:08.756066+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50058	18.197.239.5	11048	TCP
2024-12-28T21:10:11.120478+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50059	18.197.239.5	11048	TCP
2024-12-28T21:10:14.064612+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50060	18.192.93.86	11048	TCP
2024-12-28T21:10:16.496582+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50061	18.192.93.86	11048	TCP
2024-12-28T21:10:18.997271+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50062	18.192.93.86	11048	TCP
2024-12-28T21:10:21.380181+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50063	18.192.93.86	11048	TCP
2024-12-28T21:10:23.833271+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50064	18.192.93.86	11048	TCP
2024-12-28T21:10:26.223684+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50065	18.192.93.86	11048	TCP
2024-12-28T21:10:28.631109+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50066	18.192.93.86	11048	TCP
2024-12-28T21:10:31.670987+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50067	18.192.93.86	11048	TCP
2024-12-28T21:10:33.140094+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50068	18.192.93.86	11048	TCP
2024-12-28T21:10:34.823236+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50069	18.192.93.86	11048	TCP
2024-12-28T21:10:36.299021+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50070	18.192.93.86	11048	TCP
2024-12-28T21:10:38.584287+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50071	18.192.93.86	11048	TCP
2024-12-28T21:10:39.484267+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50072	18.192.93.86	11048	TCP
2024-12-28T21:10:41.410969+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50073	18.192.93.86	11048	TCP
2024-12-28T21:10:42.743875+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50074	18.192.93.86	11048	TCP
2024-12-28T21:10:44.261786+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50075	18.192.93.86	11048	TCP
2024-12-28T21:10:45.886881+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50076	18.192.93.86	11048	TCP
2024-12-28T21:10:47.571861+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50077	18.192.93.86	11048	TCP
2024-12-28T21:10:49.117583+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50078	18.192.93.86	11048	TCP
2024-12-28T21:10:50.688877+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50079	18.192.93.86	11048	TCP
2024-12-28T21:10:52.219293+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50080	18.192.93.86	11048	TCP
2024-12-28T21:10:53.853639+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50081	18.192.93.86	11048	TCP
2024-12-28T21:10:55.420699+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50082	18.192.93.86	11048	TCP
2024-12-28T21:10:56.916319+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50083	18.192.93.86	11048	TCP
2024-12-28T21:10:59.130080+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50084	18.192.93.86	11048	TCP
2024-12-28T21:11:00.627393+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.4	50085	18.192.93.86	11048	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: oiA5KmV0f0.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Avira: detection malicious, Label: TR/Dropper.Gen7
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Avira: detection malicious, Label: TR/Dropper.Gen7
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Avira: detection malicious, Label: TR/Dropper.Gen7

Found malware configuration

Source: 0.0.oiA5KmV0f0.exe.370000.0.unpack

Malware Configuration Extractor: Njrat {"Install Dir": "AppData", "Install Name": "Dllhost.exe", "Startup": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Campaign ID": "HacKed", "Version": "Njrat 0.7 Golden By Hassan Amiri", "Network Seprator": "|Hassan|", "Mutex": "Windows Update", "Install Flag": ""}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Server.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Virustotal: Detection: 83%	Perma Link
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Virustotal: Detection: 83%	Perma Link
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Virustotal: Detection: 83%	Perma Link

Multi AV Scanner detection for submitted file

Source: oiA5KmV0f0.exe	ReversingLabs: Detection: 86%
Source: oiA5KmV0f0.exe	Virustotal: Detection: 75%			Perma Link

Yara detected Njrat

Source: Yara match	File source: oiA5KmV0f0.exe, type: SAMPLE
Source: Yara match	File source: 0.0.oiA5KmV0f0.exe.370000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oiA5KmV0f0.exe.2633ffc.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oiA5KmV0f0.exe.2633ffc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1717580034.000000000261E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1717580034.0000000002611000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1649870964.0000000000372000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: oiA5KmV0f0.exe PID: 6552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Dllhost.exe PID: 4464, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Server.exe PID: 6944, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Java update.exe PID: 4076, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Server.exe PID: 5672, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Dllhost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Server.exe, type: DROPPED

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: oiA5KmV0f0.exe

Joe Sandbox ML: detected

Source: oiA5KmV0f0.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: oiA5KmV0f0.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49739 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49739 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49743 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49739 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49741 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49740 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49740 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49744 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49739 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49736 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49736 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49742 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49742 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49742 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49742 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49732 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49740 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49744 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49730 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49730 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2825563 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) : 192.168.2.4:49739 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49732 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49732 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49732 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49744 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49744 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2825563 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) : 192.168.2.4:49732 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2825563 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) : 192.168.2.4:49744 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2838486 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf) : 192.168.2.4:49744 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2838486 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf) : 192.168.2.4:49739 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49743 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49736 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2838486 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf) : 192.168.2.4:49732 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49730 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49739 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49745 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49741 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49732 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49740 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49743 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49743 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49736 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49730 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49749 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49749 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49749 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49749 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2825563 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) : 192.168.2.4:49736 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2838486 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf) : 192.168.2.4:49736 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2825563 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) : 192.168.2.4:49730 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2825563 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) : 192.168.2.4:49749 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2838486 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf) : 192.168.2.4:49749 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2825563 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) : 192.168.2.4:49740 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2838486 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf) : 192.168.2.4:49740 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2825563 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) : 192.168.2.4:49742 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2838486 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf) : 192.168.2.4:49730 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49749 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49745 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49745 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49771 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49771 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49760 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49760 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49760 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49760 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49801 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49801 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49801 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49801 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2825563 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) : 192.168.2.4:49760 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2838486 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf) : 192.168.2.4:49760 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49801 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49760 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49745 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49746 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49746 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49746 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49782 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49782 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49782 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49782 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49782 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49791 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49791 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49791 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49791 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49771 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49860 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49860 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49860 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49860 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2838486 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf) : 192.168.2.4:49742 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49812 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49812 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49860 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49812 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49741 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49845 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49845 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49771 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49866 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49741 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2825563 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) : 192.168.2.4:49741 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2838486 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf) : 192.168.2.4:49741 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49845 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49845 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49866 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49812 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49866 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49878 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49866 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49878 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49845 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49878 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49741 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2825563 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) : 192.168.2.4:49771 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2825563 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) : 192.168.2.4:49745 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49866 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2838486 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf) : 192.168.2.4:49771 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2838486 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf) : 192.168.2.4:49745 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49771 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49838 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49838 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49746 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49822 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49878 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49791 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2825563 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) : 192.168.2.4:49746 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49890 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49872 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49890 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49872 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49890 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49872 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49884 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49878 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49884 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49884 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49838 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49838 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49890 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2838486 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf) : 192.168.2.4:49746 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49896 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49746 -> 3.126.37.18:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49872 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49838 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49890 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49822 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49872 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49884 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49812 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49896 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49884 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49896 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49896 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49896 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49910 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49822 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49822 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49910 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49910 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49910 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49920 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49852 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49822 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49852 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49852 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49910 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49932 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49932 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49932 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49932 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49852 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49932 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49830 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49830 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49938 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49938 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49938 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49938 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49938 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49944 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49920 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49920 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49830 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49830 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49926 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49904 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49904 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49830 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49904 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49962 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49962 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49944 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49962 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49944 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49962 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49920 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49904 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49981 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49962 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49975 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49926 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49920 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49981 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49981 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49981 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50004 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49969 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49969 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49914 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49988 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49904 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49914 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49914 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49914 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49981 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49944 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49975 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49975 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49944 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49914 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49994 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49988 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50004 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50004 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49926 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50007 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50007 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50007 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49988 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49988 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49987 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49987 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49987 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50004 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49926 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49969 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49964 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49950 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49950 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49964 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49950 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50007 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49964 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49950 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49975 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49950 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49975 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50007 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50000 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49969 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50019 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50004 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49964 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49926 -> 18.156.13.209:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49969 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49964 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50026 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49987 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50000 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50019 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50019 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50024 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50019 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50024 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50024 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49987 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49994 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50024 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49956 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50024 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50019 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50026 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50000 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49956 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49956 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50026 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49956 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50000 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50026 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50000 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:49994 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50026 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:49994 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49956 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49994 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50057 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50057 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50057 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50057 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50059 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50059 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50058 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50059 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50059 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50060 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50058 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50058 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50058 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50059 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50057 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50058 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50064 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50064 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50064 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50064 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50066 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50066 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50067 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50066 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50064 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50060 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50066 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50060 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50013 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50013 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50067 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50061 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50067 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50071 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50072 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50071 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50068 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50060 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50066 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50067 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50062 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50061 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50067 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50061 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50068 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50061 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50013 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50072 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50062 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50072 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50072 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50062 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50061 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50068 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50060 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50068 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50074 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50071 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50013 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50062 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50072 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50074 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50079 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50079 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50071 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50079 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50079 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50083 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50083 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50074 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50080 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50080 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50080 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50084 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50080 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50083 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50079 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50068 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50013 -> 18.197.239.5:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50074 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50080 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50070 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50083 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50084 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50076 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50076 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50084 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50076 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50084 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50062 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50063 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50063 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50070 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50084 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50070 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50074 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50071 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50076 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50063 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50063 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50081 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50081 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50073 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50073 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50063 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50073 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50073 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50070 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50081 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50076 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50081 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50085 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50085 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50085 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50085 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50073 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50065 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50065 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50065 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50065 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50081 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50085 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50065 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50070 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50077 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50075 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50082 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50082 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50082 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50082 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50082 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50069 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50069 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50069 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50069 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50069 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50075 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50077 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50075 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50077 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50075 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50077 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50078 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50078 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2815696 - Severity 1 - ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon : 192.168.2.4:50078 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50075 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50077 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.4:50078 -> 18.192.93.86:11048
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50078 -> 18.192.93.86:11048

System process connects to network (likely due to code injection or exploit)

Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Network Connect: 3.126.37.18 11048	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Network Connect: 18.156.13.209 11048	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Network Connect: 18.197.239.5 11048	Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.4:49730 -> 3.126.37.18:11048
Source: global traffic	TCP traffic: 192.168.2.4:49782 -> 18.156.13.209:11048
Source: global traffic	TCP traffic: 192.168.2.4:49932 -> 18.197.239.5:11048
Source: global traffic	TCP traffic: 192.168.2.4:50060 -> 18.192.93.86:11048

Source: Joe Sandbox View	IP Address: 3.126.37.18 3.126.37.18
Source: Joe Sandbox View	IP Address: 18.156.13.209 18.156.13.209
Source: Joe Sandbox View	IP Address: 18.192.93.86 18.192.93.86
Source: Joe Sandbox View	IP Address: 18.197.239.5 18.197.239.5

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: 2.tcp.eu.ngrok.io

E-Banking Fraud

Yara detected Njrat

Source: Yara match	File source: oiA5KmV0f0.exe, type: SAMPLE
Source: Yara match	File source: 0.0.oiA5KmV0f0.exe.370000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oiA5KmV0f0.exe.2633ffc.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oiA5KmV0f0.exe.2633ffc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1717580034.000000000261E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1717580034.0000000002611000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1649870964.0000000000372000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: oiA5KmV0f0.exe PID: 6552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Dllhost.exe PID: 4464, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Server.exe PID: 6944, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Java update.exe PID: 4076, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Server.exe PID: 5672, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Dllhost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Server.exe, type: DROPPED

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\AppData\Roaming\Dllhost.exe

Process information set: 01 00 00 00

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: oiA5KmV0f0.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: oiA5KmV0f0.exe, type: SAMPLE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: oiA5KmV0f0.exe, type: SAMPLE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.0.oiA5KmV0f0.exe.370000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.0.oiA5KmV0f0.exe.370000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.0.oiA5KmV0f0.exe.370000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.oiA5KmV0f0.exe.2633ffc.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.2.oiA5KmV0f0.exe.2633ffc.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.2.oiA5KmV0f0.exe.2633ffc.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.oiA5KmV0f0.exe.2633ffc.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.2.oiA5KmV0f0.exe.2633ffc.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.2.oiA5KmV0f0.exe.2633ffc.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.1717580034.000000000261E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000002.1717580034.000000000261E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000000.1649870964.0000000000372000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000000.1649870964.0000000000372000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\Dllhost.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Dllhost.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Local\Temp\Server.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Dllhost.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Local\Temp\Server.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Local\Temp\Server.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group

Source: C:\Users\user\AppData\Roaming\Dllhost.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Code function: 1_2_054B2B38 NtSetInformationProcess,	1_2_054B2B38
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Code function: 1_2_054B2B30 NtSetInformationProcess,	1_2_054B2B30
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Code function: 1_2_054B2BD8 NtSetInformationProcess,	1_2_054B2BD8

Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Code function: 1_2_0530AA20	1_2_0530AA20
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Code function: 1_2_0530AA15	1_2_0530AA15
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Code function: 1_2_054B0040	1_2_054B0040
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Code function: 1_2_054B95D8	1_2_054B95D8
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Code function: 1_2_054B0D80	1_2_054B0D80
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Code function: 1_2_054BBE80	1_2_054BBE80
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Code function: 1_2_055F8608	1_2_055F8608
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Code function: 1_2_055F8ED8	1_2_055F8ED8
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Code function: 1_2_055F28A0	1_2_055F28A0
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Code function: 1_2_055F93C9	1_2_055F93C9
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Code function: 1_2_055F82C0	1_2_055F82C0
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Code function: 1_2_055F3298	1_2_055F3298
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Code function: 10_2_026A3808	10_2_026A3808

Source: oiA5KmV0f0.exe, 00000000.00000002.1716230547.000000000094E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameclr.dllT vs oiA5KmV0f0.exe

Source: oiA5KmV0f0.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: oiA5KmV0f0.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: oiA5KmV0f0.exe, type: SAMPLE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: oiA5KmV0f0.exe, type: SAMPLE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.0.oiA5KmV0f0.exe.370000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.0.oiA5KmV0f0.exe.370000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.oiA5KmV0f0.exe.370000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.2.oiA5KmV0f0.exe.2633ffc.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.2.oiA5KmV0f0.exe.2633ffc.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.oiA5KmV0f0.exe.2633ffc.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.2.oiA5KmV0f0.exe.2633ffc.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.2.oiA5KmV0f0.exe.2633ffc.0.raw.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.oiA5KmV0f0.exe.2633ffc.0.raw.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000000.00000002.1717580034.000000000261E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000002.1717580034.000000000261E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000000.00000000.1649870964.0000000000372000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000000.1649870964.0000000000372000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\Dllhost.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Dllhost.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Local\Temp\Server.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Dllhost.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Local\Temp\Server.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Local\Temp\Server.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan

Source: classification engine

Classification label: mal100.phis.troj.adwa.evad.winEXE@15/7@4/4

Source: C:\Users\user\Desktop\oiA5KmV0f0.exe

File created: C:\Users\user\AppData\Roaming\Dllhost.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3808:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Windows Update

Source: C:\Users\user\AppData\Roaming\Dllhost.exe

File created: C:\Users\user\AppData\Local\Temp\Server.exe

Jump to behavior

Source: oiA5KmV0f0.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: oiA5KmV0f0.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\oiA5KmV0f0.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\oiA5KmV0f0.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: oiA5KmV0f0.exe	ReversingLabs: Detection: 86%
Source: oiA5KmV0f0.exe	Virustotal: Detection: 75%

Source: C:\Users\user\Desktop\oiA5KmV0f0.exe

File read: C:\Users\user\Desktop\oiA5KmV0f0.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\oiA5KmV0f0.exe "C:\Users\user\Desktop\oiA5KmV0f0.exe"
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Process created: C:\Users\user\AppData\Roaming\Dllhost.exe "C:\Users\user\AppData\Roaming\Dllhost.exe"
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\user\AppData\Local\Temp/Server.exe
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Server.exe C:\Users\user\AppData\Local\Temp/Server.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Dllhost.exe "C:\Users\user\AppData\Roaming\Dllhost.exe" ..
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Dllhost.exe "C:\Users\user\AppData\Roaming\Dllhost.exe" ..
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Dllhost.exe "C:\Users\user\AppData\Roaming\Dllhost.exe" ..
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Server.exe C:\Users\user\AppData\Local\Temp/Server.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Server.exe C:\Users\user\AppData\Local\Temp/Server.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Server.exe C:\Users\user\AppData\Local\Temp/Server.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Server.exe C:\Users\user\AppData\Local\Temp/Server.exe
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Process created: C:\Users\user\AppData\Roaming\Dllhost.exe "C:\Users\user\AppData\Roaming\Dllhost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\user\AppData\Local\Temp/Server.exe	Jump to behavior

Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: wldp.dll

Source: C:\Users\user\Desktop\oiA5KmV0f0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: oiA5KmV0f0.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: oiA5KmV0f0.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: oiA5KmV0f0.exe, OK.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Dllhost.exe.0.dr, OK.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: 0.2.oiA5KmV0f0.exe.2633ffc.0.raw.unpack, OK.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Java update.exe.1.dr, OK.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Server.exe.1.dr, OK.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\AppData\Roaming\Dllhost.exe

Code function: 10_2_026A0006 push 00000002h; iretd

10_2_026A001C

Source: C:\Users\user\AppData\Roaming\Dllhost.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\Server.exe	Jump to dropped file
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	File created: C:\Users\user\AppData\Roaming\Dllhost.exe	Jump to dropped file

Boot Survival

Drops PE files to the startup folder

Source: C:\Users\user\AppData\Roaming\Dllhost.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe

Jump to dropped file

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Roaming\Dllhost.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\user\AppData\Local\Temp/Server.exe

Source: C:\Users\user\AppData\Roaming\Dllhost.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Dllhost.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows Update	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows Update	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Windows Update	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Windows Update	Jump to behavior

Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Memory allocated: CB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Memory allocated: 2610000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Memory allocated: 4610000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Memory allocated: 2DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Memory allocated: 2E80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Memory allocated: 2DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Memory allocated: 11B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Memory allocated: 2C30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Memory allocated: 2970000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Memory allocated: 2B10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Memory allocated: 2D10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Memory allocated: 2B10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Memory allocated: 2840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Memory allocated: 28F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Memory allocated: 2840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Memory allocated: 2660000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Memory allocated: 2840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Memory allocated: 4840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Memory allocated: 1690000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Memory allocated: 3160000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Memory allocated: 5160000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Memory allocated: 27C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Memory allocated: 29A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Memory allocated: 49A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Memory allocated: E90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Memory allocated: 2B60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Memory allocated: 4B60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Memory allocated: 1090000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Memory allocated: 29D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Memory allocated: 49D0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Window / User API: threadDelayed 816	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Window / User API: threadDelayed 3872	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Window / User API: threadDelayed 4278	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Window / User API: foregroundWindowGot 652	Jump to behavior

Source: C:\Users\user\Desktop\oiA5KmV0f0.exe TID: 6580	Thread sleep count: 53 > 30	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe TID: 6396	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe TID: 6120	Thread sleep time: -81600s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe TID: 1076	Thread sleep time: -3872000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe TID: 1076	Thread sleep time: -4278000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe TID: 2144	Thread sleep count: 42 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe TID: 2056	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe TID: 4324	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe TID: 4268	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe TID: 1028	Thread sleep count: 44 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe TID: 4956	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe TID: 3368	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe TID: 2056	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe TID: 7076	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe TID: 2364	Thread sleep count: 44 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe TID: 3004	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe TID: 5848	Thread sleep count: 44 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe TID: 5700	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe TID: 5376	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Server.exe TID: 2848	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Server.exe TID: 3264	Thread sleep count: 49 > 30
Source: C:\Users\user\AppData\Local\Temp\Server.exe TID: 3068	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Server.exe TID: 280	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Thread delayed: delay time: 922337203685477

Source: Dllhost.exe, 00000001.00000002.4122265383.0000000001009000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Roaming\Dllhost.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\oiA5KmV0f0.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Network Connect: 3.126.37.18 11048	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Network Connect: 18.156.13.209 11048	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Network Connect: 18.197.239.5 11048	Jump to behavior

Source: C:\Users\user\Desktop\oiA5KmV0f0.exe

Process created: C:\Users\user\AppData\Roaming\Dllhost.exe "C:\Users\user\AppData\Roaming\Dllhost.exe"

Jump to behavior

Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/22 \| 17:06:36 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/30 \| 09:56:20 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/12 \| 06:04:09 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/23 \| 03:11:28 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/12 \| 10:14:44 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/18 \| 03:51:56 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/24 \| 20:52:31 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/11 \| 16:53:40 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/22 \| 11:41:00 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/04 \| 14:17:10 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/12 \| 23:49:27 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/14 \| 14:38:19 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/18 \| 22:19:56 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/13 \| 00:30:31 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/15 \| 23:44:46 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/11 \| 00:32:12 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/12 \| 10:24:03 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/12 \| 10:09:26 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/01 \| 03:03:16 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 22:50:11 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 22:35:34 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/21 \| 19:57:31 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/18 \| 09:20:04 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 21:27:30 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/12 \| 10:34:38 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/08 \| 01:56:08 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/03 \| 17:05:35 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/12 \| 10:13:14 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/01 \| 10:32:21 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 14:49:33 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/21 \| 16:22:42 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/07/06 \| 20:20:58 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/05 \| 09:57:13 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/19 \| 15:05:15 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/25 \| 10:57:28 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/11 \| 00:37:29 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/12 \| 10:45:27 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/21 \| 16:18:54 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/10 \| 02:01:58 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 15:22:24 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/11 \| 16:48:22 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/16 \| 00:25:49 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/03 \| 17:16:24 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 15:57:37 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 15:03:09 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 22:56:58 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/18 \| 23:05:06 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/26 \| 19:09:50 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/07 \| 14:40:13 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/29 \| 18:59:19 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/07 \| 14:30:54 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 15:46:48 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/04 \| 14:16:56 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/12 \| 11:18:21 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/05 \| 10:31:14 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/12 \| 23:43:56 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 14:14:20 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/23 \| 03:28:25 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/21 \| 02:58:57 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/14 \| 15:48:44 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/28 \| 02:32:48 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/11 \| 00:39:13 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/20 \| 23:00:31 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/08 \| 01:47:03 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/22 \| 11:27:53 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/03 \| 16:55:10 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 21:31:57 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/22 \| 11:40:09 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/23 \| 03:02:23 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 14:38:44 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/14 \| 15:26:29 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/25 \| 10:48:23 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/14 \| 15:20:58 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/21 \| 03:02:35 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 21:39:27 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/03 \| 02:15:31 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/08 \| 02:12:05 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/07 \| 09:40:41 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/13 \| 00:51:55 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/26 \| 18:34:33 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/07 \| 14:52:32 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/22 \| 17:28:14 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/01 \| 02:58:45 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/10 \| 20:17:49 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/07/04 \| 16:56:12 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/12 \| 06:37:13 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 23:22:14 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/21 \| 02:53:40 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 15:48:32 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/18 \| 09:21:34 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 22:04:51 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 13:55:15 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/30 \| 06:30:36 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/09 \| 18:23:46 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/28 \| 02:54:26 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/12 \| 06:53:20 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/25 \| 06:54:32 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 15:05:30 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/08 \| 01:15:29 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/08 \| 01:59:22 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/18 \| 22:42:08 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 02:37:41 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/26 \| 02:59:21 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/08 \| 02:34:20 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/23 \| 03:32:13 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/21 \| 02:49:52 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4123651548.000000000308A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 20:44:01 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/03 \| 14:03:35 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/21 \| 19:52:53 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 15:39:21 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 14:57:08 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/19 \| 16:13:56 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 21:38:34 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/11 \| 22:11:32 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 14:23:31 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/17 \| 08:38:30 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/07 \| 14:41:06 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/22 \| 17:11:17 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/17 \| 07:43:58 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/05 \| 20:41:34 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4123651548.000000000308A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 21:04:22 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/30 \| 06:39:21 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/20 \| 22:42:11 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 13:47:40 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/08 \| 01:46:10 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/21 \| 02:36:40 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/26 \| 20:09:53 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/19 \| 16:24:45 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4123651548.000000000308A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 20:21:30 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/16 \| 00:25:10 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/08 \| 00:51:38 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/12 \| 05:54:21 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/29 \| 19:01:33 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/21 \| 16:11:16 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/12 \| 11:08:25 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/22 \| 11:00:21 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/14 \| 14:48:15 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/23 \| 23:36:14 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/17 \| 07:50:23 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/11 \| 00:10:34 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/17 \| 11:10:39 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 02:54:41 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/11 \| 16:32:55 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/01 \| 13:34:21 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/26 \| 18:54:27 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/01 \| 10:27:40 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/21 \| 15:46:14 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 15:25:24 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/12 \| 06:20:53 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4123651548.000000000308A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 20:37:36 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/26 \| 19:39:40 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/10 \| 20:10:48 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 14:17:20 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/13 \| 00:58:56 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/10 \| 02:17:25 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/23 \| 02:58:45 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/22 \| 17:27:21 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/16 \| 05:44:48 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/08 \| 02:07:24 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/20 \| 23:03:25 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/25 \| 10:17:03 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 02:53:11 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 14:26:02 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/22 \| 11:35:28 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/26 \| 19:45:51 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/10 \| 01:58:34 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/26 \| 19:55:10 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/14 \| 15:09:29 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/05 \| 21:01:18 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 14:51:37 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4123651548.000000000308A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 20:26:47 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/28 \| 23:35:23 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 03:15:55 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4123651548.000000000308A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 20:43:47 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/21 \| 20:00:12 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/01 \| 03:18:29 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/11 \| 00:42:47 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/15 \| 07:31:56 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/28 \| 03:06:35 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/11 \| 00:52:06 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/05 \| 10:52:38 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 22:03:36 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 14:15:36 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/08 \| 02:19:06 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/05 \| 10:11:20 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/03 \| 14:20:35 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/29 \| 03:37:27 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/01 \| 10:11:36 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/01 \| 10:17:07 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/11 \| 16:39:56 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/11 \| 16:51:19 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 22:24:08 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/12 \| 06:54:50 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/13 \| 00:34:18 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/22 \| 11:30:11 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 16:42:00 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/26 \| 02:55:14 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 14:29:02 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 14:19:43 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/26 \| 19:08:20 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/14 \| 15:45:50 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/01 \| 03:20:53 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/21 \| 16:02:11 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/22 \| 16:33:03 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/21 \| 03:13:24 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 15:49:25 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/12 \| 06:01:15 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/23 \| 03:30:29 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 23:15:49 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/21 \| 03:06:59 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/19 \| 15:07:38 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4123651548.000000000308A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 21:01:08 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/22 \| 10:56:43 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/12 \| 05:50:36 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/01 \| 03:10:57 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 22:37:57 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 15:19:13 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 21:44:30 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/17 \| 08:20:40 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/29 \| 19:08:34 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/15 \| 07:35:41 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/19 \| 15:02:21 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/05 \| 10:25:03 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/03 \| 02:10:16 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/17 \| 11:15:17 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 23:12:55 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/19 \| 16:10:25 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/01 \| 10:44:03 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/12 \| 06:55:43 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/21 \| 03:00:12 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/23 \| 02:41:48 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/12 \| 10:06:32 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/18 \| 09:22:27 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/16 \| 05:40:24 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/03 \| 17:08:12 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/12 \| 23:45:03 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/01 \| 10:08:02 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/13 \| 00:07:59 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/11 \| 16:22:59 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/19 \| 15:42:09 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/26 \| 19:36:26 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/08 \| 00:57:46 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/18 \| 04:11:01 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/22 \| 17:13:01 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/05 \| 20:53:53 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 14:04:47 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/14 \| 02:03:28 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/21 \| 03:01:42 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/05 \| 20:34:30 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/07 \| 14:37:18 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/21 \| 16:25:36 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/14 \| 15:43:29 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/07 \| 14:40:50 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/17 \| 11:45:29 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/01 \| 10:13:20 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/14 \| 02:06:20 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/30 \| 09:51:05 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 22:48:46 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/21 \| 15:42:07 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/16 \| 00:08:10 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/01 \| 03:23:47 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/13 \| 00:51:18 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/26 \| 02:56:44 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/23 \| 03:04:46 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/07/06 \| 20:19:25 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/18 \| 03:55:04 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4123651548.000000000308A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 21:13:27 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 13:41:49 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 21:56:27 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/08 \| 02:18:50 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/21 \| 16:09:29 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/23 \| 02:44:40 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/03 \| 02:22:35 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/22 \| 11:19:41 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/05 \| 21:18:52 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 15:28:18 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/12 \| 06:14:42 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/13 \| 00:45:44 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/13 \| 00:15:17 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/20 \| 23:12:13 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/05 \| 20:33:39 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/14 \| 01:52:49 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/30 \| 06:43:48 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 15:38:36 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/11 \| 21:51:28 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4123651548.000000000308A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 18:35:57 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 03:18:49 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/05 \| 21:27:40 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/05 \| 20:39:47 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/05 \| 20:43:35 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4123651548.000000000308A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 21:11:26 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 15:23:17 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/18 \| 04:16:18 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/05 \| 21:00:25 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 15:37:20 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/14 \| 14:55:19 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/12 \| 10:43:04 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/25 \| 10:28:09 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/03 \| 14:17:01 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 03:19:40 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4123651548.0000000002E85000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/07/06 \| 20:18:17 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 14:27:32 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/17 \| 08:25:57 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/12 \| 05:37:21 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4123651548.000000000308A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 16:44:24 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 23:04:43 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4123651548.000000000308A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 15:08:53 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/26 \| 19:48:45 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/22 \| 11:07:39 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/07 \| 14:28:13 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 22:00:07 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/13 \| 00:00:58 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 14:34:20 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/19 \| 15:29:53 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/20 \| 23:08:25 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/23 \| 06:50:59 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/09 \| 18:12:57 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/20 \| 22:46:35 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/19 \| 16:20:21 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 13:55:52 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/23 \| 02:47:56 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/21 \| 19:59:17 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/22 \| 16:11:25 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/14 \| 01:32:33 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/08 \| 01:12:35 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/21 \| 16:13:17 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 23:05:51 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/26 \| 19:05:06 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/26 \| 19:41:07 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/08 \| 02:20:39 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/13 \| 00:38:03 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 21:58:28 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/25 \| 10:42:15 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/22 \| 11:03:15 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/05 \| 20:33:22 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/07/06 \| 20:21:12 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/18 \| 09:14:30 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/23 \| 02:54:21 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/25 \| 10:15:56 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/12 \| 05:57:37 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/11 \| 00:48:55 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/05 \| 20:55:17 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/18 \| 22:31:19 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/23 \| 03:30:12 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/14 \| 01:51:56 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/05 \| 10:12:13 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/16 \| 05:49:26 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/03 \| 02:19:18 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/12 \| 10:42:11 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 22:32:55 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/12 \| 06:12:41 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/14 \| 02:00:12 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 22:34:19 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/24 \| 15:06:25 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 22:42:38 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/03 \| 02:17:54 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/26 \| 20:15:27 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/14 \| 15:29:43 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/22 \| 17:34:03 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/05 \| 18:15:11 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/11 \| 21:47:23 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 22:11:33 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 14:30:07 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/20 \| 22:37:30 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/17 \| 11:14:24 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 22:53:27 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/23 \| 06:48:55 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/14 \| 14:46:14 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 14:19:06 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/18 \| 04:03:28 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4123651548.000000000308A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 20:35:35 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 14:47:26 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 21:40:21 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/13 \| 00:46:37 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/14 \| 15:27:59 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/08 \| 01:03:30 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/26 \| 19:15:24 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/22 \| 15:58:05 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/16 \| 05:51:50 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/01 \| 02:57:52 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/05 \| 17:48:25 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/21 \| 03:17:48 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 15:15:20 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 14:07:24 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/01 \| 10:19:08 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/21 \| 19:51:23 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/23 \| 02:42:19 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/05 \| 10:28:56 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/25 \| 06:51:18 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 14:29:19 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/01 \| 13:35:14 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/25 \| 10:55:05 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/23 \| 19:45:17 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/19 \| 15:44:30 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/23 \| 02:40:55 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/29 \| 03:40:22 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/24 \| 20:54:17 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/21 \| 16:02:28 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/01 \| 03:14:05 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/26 \| 19:37:19 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 02:45:53 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/18 \| 22:41:37 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/10 \| 20:09:15 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/26 \| 18:48:38 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/21 \| 03:04:36 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 03:12:24 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/04 \| 13:57:43 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/05 \| 06:01:44 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/19 \| 16:09:51 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/26 \| 19:27:43 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/19 \| 15:11:04 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/26 \| 20:18:04 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 03:04:07 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/17 \| 08:08:57 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/29 \| 19:05:40 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 15:43:32 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/22 \| 17:20:42 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/11 \| 16:54:11 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 23:13:26 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/26 \| 20:08:45 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 22:08:51 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/17 \| 11:15:39 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/21 \| 16:19:25 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/01 \| 10:08:56 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/21 \| 02:35:32 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/09 \| 18:16:42 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/22 \| 16:41:52 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/27 \| 00:17:51 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/30 \| 06:25:01 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/22 \| 17:36:48 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/17 \| 08:41:10 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/12 \| 10:18:14 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 22:48:09 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/24 \| 15:05:10 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/22 \| 16:00:58 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/12 \| 11:16:59 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 02:51:10 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/18 \| 22:57:58 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4123651548.0000000002F9F000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 21:23:08 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 02:41:51 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 15:35:14 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/16 \| 00:22:18 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 22:59:50 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/08 \| 01:38:15 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/11 \| 16:19:40 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/05 \| 10:52:21 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/08 \| 01:28:56 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 14:15:58 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/22 \| 16:59:27 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/19 \| 15:50:04 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/23 \| 06:44:31 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/12 \| 10:26:04 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/11 \| 00:24:54 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/15 \| 23:52:04 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/04 \| 09:55:40 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/14 \| 01:49:30 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 14:14:28 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/20 \| 22:34:16 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/26 \| 19:52:55 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/11 \| 00:50:20 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/14 \| 15:35:17 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/30 \| 09:46:02 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 21:27:47 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 15:34:12 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 23:13:31 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/11 \| 00:12:35 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/22 \| 17:03:20 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/03 \| 14:16:25 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/12 \| 06:09:09 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/11 \| 16:58:40 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/26 \| 19:23:14 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 15:15:05 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/26 \| 18:36:34 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/11 \| 16:24:06 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/30 \| 10:09:55 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/24 \| 15:14:15 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/12 \| 11:21:01 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/30 \| 06:26:31 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/22 \| 17:16:54 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 22:39:04 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/11 \| 22:04:50 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/28 \| 02:36:18 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/12 \| 06:25:53 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/14 \| 01:41:38 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/19 \| 15:36:57 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/19 \| 16:05:22 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/19 \| 15:46:16 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/09 \| 18:19:41 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/23 \| 03:21:46 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 21:43:54 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/06/17 \| 11:19:02 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/05/09 \| 18:20:30 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/29 \| 19:11:46 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/05 \| 21:11:36 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/15 \| 04:16:04 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/04/16 \| 00:03:54 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/07/02 \| 13:40:58 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/17 \| 08:03:25 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/14 \| 15:13:54 - Program Manager
Source: Dllhost.exe, 00000001.00000002.4126399553.0000000004889000.00000004.00000800.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4126399553.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/21 \| 16:10:45 - Program Manager

Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Queries volume information: C:\Users\user\Desktop\oiA5KmV0f0.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oiA5KmV0f0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\Users\user\AppData\Roaming\Dllhost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Server.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\Users\user\AppData\Roaming\Dllhost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\Users\user\AppData\Roaming\Dllhost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\Users\user\AppData\Roaming\Dllhost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Server.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Server.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Server.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation

Source: C:\Users\user\AppData\Roaming\Dllhost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disables zone checking for all users

Source: C:\Users\user\AppData\Roaming\Dllhost.exe

Registry value created: HKEY_CURRENT_USER\Environment SEE_MASK_NOZONECHECKS

Jump to behavior

Source: Dllhost.exe, 00000001.00000002.4122265383.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4137241133.0000000006736000.00000004.00000020.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4137241133.0000000006753000.00000004.00000020.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4137071149.000000000670A000.00000004.00000020.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4122265383.0000000001009000.00000004.00000020.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4122265383.000000000104D000.00000004.00000020.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4137241133.000000000675F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Dllhost.exe, 00000001.00000002.4136929641.00000000066F1000.00000004.00000020.00020000.00000000.sdmp, Dllhost.exe, 00000001.00000002.4137071149.0000000006728000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\Server.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\Server.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected Njrat

Source: Yara match	File source: oiA5KmV0f0.exe, type: SAMPLE
Source: Yara match	File source: 0.0.oiA5KmV0f0.exe.370000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oiA5KmV0f0.exe.2633ffc.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oiA5KmV0f0.exe.2633ffc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1717580034.000000000261E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1717580034.0000000002611000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1649870964.0000000000372000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: oiA5KmV0f0.exe PID: 6552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Dllhost.exe PID: 4464, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Server.exe PID: 6944, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Java update.exe PID: 4076, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Server.exe PID: 5672, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Dllhost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Server.exe, type: DROPPED

Remote Access Functionality

Yara detected Njrat

Source: Yara match	File source: oiA5KmV0f0.exe, type: SAMPLE
Source: Yara match	File source: 0.0.oiA5KmV0f0.exe.370000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oiA5KmV0f0.exe.2633ffc.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oiA5KmV0f0.exe.2633ffc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1717580034.000000000261E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1717580034.0000000002611000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1649870964.0000000000372000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: oiA5KmV0f0.exe PID: 6552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Dllhost.exe PID: 4464, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Server.exe PID: 6944, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Java update.exe PID: 4076, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Server.exe PID: 5672, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Dllhost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Server.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Scheduled Task/Job	112 Process Injection	1 Masquerading	OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	121 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	11 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	121 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	112 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
oiA5KmV0f0.exe	86%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
oiA5KmV0f0.exe	75%	Virustotal		Browse
oiA5KmV0f0.exe	100%	Avira	TR/Dropper.Gen7
oiA5KmV0f0.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	100%	Avira	TR/Dropper.Gen7
C:\Users\user\AppData\Local\Temp\Server.exe	100%	Avira	TR/Dropper.Gen7
C:\Users\user\AppData\Roaming\Dllhost.exe	100%	Avira	TR/Dropper.Gen7
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Server.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Dllhost.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Server.exe	86%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\AppData\Local\Temp\Server.exe	83%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Dllhost.exe	86%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\AppData\Roaming\Dllhost.exe	83%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	86%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	83%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
2.tcp.eu.ngrok.io	3.126.37.18	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
3.126.37.18	2.tcp.eu.ngrok.io	United States	16509	AMAZON-02US	false
18.156.13.209	unknown	United States	16509	AMAZON-02US	true
18.192.93.86	unknown	United States	16509	AMAZON-02US	true
18.197.239.5	unknown	United States	16509	AMAZON-02US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581727
Start date and time:	2024-12-28 21:06:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	oiA5KmV0f0.exe renamed because original name is a hash value
Original Sample Name:	1917739297383bb37d4f159e8540b70b.exe
Detection:	MAL
Classification:	mal100.phis.troj.adwa.evad.winEXE@15/7@4/4
EGA Information:	Successful, ratio: 10%
HCA Information:	Successful, ratio: 94% Number of executed functions: 278 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Dllhost.exe, PID 1852 because it is empty
Execution Graph export aborted for target Dllhost.exe, PID 3300 because it is empty
Execution Graph export aborted for target Dllhost.exe, PID 6420 because it is empty
Execution Graph export aborted for target Java update.exe, PID 4076 because it is empty
Execution Graph export aborted for target Server.exe, PID 2044 because it is empty
Execution Graph export aborted for target Server.exe, PID 5672 because it is empty
Execution Graph export aborted for target Server.exe, PID 6944 because it is empty
Execution Graph export aborted for target Server.exe, PID 8 because it is empty
Execution Graph export aborted for target oiA5KmV0f0.exe, PID 6552 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:07:05	API Interceptor	381258x Sleep call for process: Dllhost.exe modified
20:07:06	Task Scheduler	Run new task: Server path: C:\Users\user\AppData\Local\Temp/Server.exe
20:07:09	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Windows Update "C:\Users\user\AppData\Roaming\Dllhost.exe" ..
20:07:17	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Windows Update "C:\Users\user\AppData\Roaming\Dllhost.exe" ..
20:07:26	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Windows Update "C:\Users\user\AppData\Roaming\Dllhost.exe" ..
20:07:35	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3.126.37.18	fBpY1pYq34.exe	Get hash	malicious	Njrat	Browse
	f3aef511705f37f9792c6032b936ca61.exe	Get hash	malicious	Njrat	Browse
	W9UAjNR4L6.exe	Get hash	malicious	Njrat	Browse
	7zFM.exe	Get hash	malicious	ZTrat	Browse
	4xKDL5YCfQ.exe	Get hash	malicious	Njrat	Browse
	b8UsrDOVGV.exe	Get hash	malicious	Njrat	Browse
	tiodtk2cfy.exe	Get hash	malicious	Njrat	Browse
	pQBmVoyRnw.exe	Get hash	malicious	Njrat	Browse
	NezbdhNgwG.exe	Get hash	malicious	Njrat	Browse
	xdPdkPMD8u.exe	Get hash	malicious	Njrat	Browse
18.156.13.209	http://www.sdrclm.cn/vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_Tax_P800.exe	Get hash	malicious	RedLine	Browse	2.tcp.eu.ngrok.io:17685/
18.192.93.86	P90GT_Invoice_Related_Property_Tax_P800.exe	Get hash	malicious	RedLine	Browse	2.tcp.eu.ngrok.io:17685/
18.192.93.86	http://www.sdrclm.cn/vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_Tax_P800.exe	Get hash	malicious	RedLine	Browse	2.tcp.eu.ngrok.io:17685/
18.197.239.5	ULNZPn6D33.exe	Get hash	malicious	Sliver	Browse	2.tcp.eu.ngrok.io:11642/e.bin
18.197.239.5	P90GT_Invoice_Related_Property_Tax_P800.exe	Get hash	malicious	RedLine	Browse	2.tcp.eu.ngrok.io:17685/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
2.tcp.eu.ngrok.io	7166_output.vbs	Get hash	malicious	AsyncRAT	Browse	18.156.13.209
	fBpY1pYq34.exe	Get hash	malicious	Njrat	Browse	18.157.68.73
	f3aef511705f37f9792c6032b936ca61.exe	Get hash	malicious	Njrat	Browse	3.126.37.18
	W9UAjNR4L6.exe	Get hash	malicious	Njrat	Browse	3.126.37.18
	ULNZPn6D33.exe	Get hash	malicious	Sliver	Browse	18.197.239.5
	Injector.exe	Get hash	malicious	ZTrat	Browse	18.197.239.5
	7zFM.exe	Get hash	malicious	ZTrat	Browse	3.126.37.18
	Game Laucher.exe	Get hash	malicious	Njrat	Browse	18.192.93.86
	10.exe	Get hash	malicious	Unknown	Browse	18.192.93.86
	En3e396wX1.exe	Get hash	malicious	Njrat	Browse	18.197.239.5

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	db0fa4b8db0333367e9bda3ab68b8042.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse	35.75.100.61
	arm6.elf	Get hash	malicious	Gafgyt	Browse	54.171.230.55
	wlw68k.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	nshkarm5.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	https://app.slintel-privacy.com/links/J95tSop4o/SS6JytVVw/qm84IUL58/GFC-9kqk1-	Get hash	malicious	Unknown	Browse	3.109.113.207
	http://prowebideas.com/dsfdgfhgdfsdfdgfhgdrwet/gdfsdfdgfhgfgdfsdfdgfh/gfsdfdgfhgfgdfsdfdgfhgdfsdfdgfh	Get hash	malicious	Unknown	Browse	44.237.4.100
	arm6.elf	Get hash	malicious	Gafgyt	Browse	54.171.230.55
	yakuza.arm4.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	45.200.149.186-boatnet.arm6-2024-12-28T01_23_00.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	https://haleborealis.com	Get hash	malicious	Unknown	Browse	108.158.75.126
AMAZON-02US	db0fa4b8db0333367e9bda3ab68b8042.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse	35.75.100.61
	arm6.elf	Get hash	malicious	Gafgyt	Browse	54.171.230.55
	wlw68k.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	nshkarm5.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	https://app.slintel-privacy.com/links/J95tSop4o/SS6JytVVw/qm84IUL58/GFC-9kqk1-	Get hash	malicious	Unknown	Browse	3.109.113.207
	http://prowebideas.com/dsfdgfhgdfsdfdgfhgdrwet/gdfsdfdgfhgfgdfsdfdgfh/gfsdfdgfhgfgdfsdfdgfhgdfsdfdgfh	Get hash	malicious	Unknown	Browse	44.237.4.100
	arm6.elf	Get hash	malicious	Gafgyt	Browse	54.171.230.55
	yakuza.arm4.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	45.200.149.186-boatnet.arm6-2024-12-28T01_23_00.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	https://haleborealis.com	Get hash	malicious	Unknown	Browse	108.158.75.126
AMAZON-02US	db0fa4b8db0333367e9bda3ab68b8042.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse	35.75.100.61
	arm6.elf	Get hash	malicious	Gafgyt	Browse	54.171.230.55
	wlw68k.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	nshkarm5.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	https://app.slintel-privacy.com/links/J95tSop4o/SS6JytVVw/qm84IUL58/GFC-9kqk1-	Get hash	malicious	Unknown	Browse	3.109.113.207
	http://prowebideas.com/dsfdgfhgdfsdfdgfhgdrwet/gdfsdfdgfhgfgdfsdfdgfh/gfsdfdgfhgfgdfsdfdgfhgdfsdfdgfh	Get hash	malicious	Unknown	Browse	44.237.4.100
	arm6.elf	Get hash	malicious	Gafgyt	Browse	54.171.230.55
	yakuza.arm4.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	45.200.149.186-boatnet.arm6-2024-12-28T01_23_00.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	https://haleborealis.com	Get hash	malicious	Unknown	Browse	108.158.75.126
AMAZON-02US	db0fa4b8db0333367e9bda3ab68b8042.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse	35.75.100.61
	arm6.elf	Get hash	malicious	Gafgyt	Browse	54.171.230.55
	wlw68k.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	nshkarm5.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	https://app.slintel-privacy.com/links/J95tSop4o/SS6JytVVw/qm84IUL58/GFC-9kqk1-	Get hash	malicious	Unknown	Browse	3.109.113.207
	http://prowebideas.com/dsfdgfhgdfsdfdgfhgdrwet/gdfsdfdgfhgfgdfsdfdgfh/gfsdfdgfhgfgdfsdfdgfhgdfsdfdgfh	Get hash	malicious	Unknown	Browse	44.237.4.100
	arm6.elf	Get hash	malicious	Gafgyt	Browse	54.171.230.55
	yakuza.arm4.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	45.200.149.186-boatnet.arm6-2024-12-28T01_23_00.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	https://haleborealis.com	Get hash	malicious	Unknown	Browse	108.158.75.126

Process:	C:\Users\user\AppData\Roaming\Dllhost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	507
Entropy (8bit):	5.344008188221104
Encrypted:	false
SSDEEP:	12:Q3La/hz92n4M0kvoDLI4MWuCqDLI4MWuPTAq1KDLI4M6:MLU84jE4K5E4KH1qE4j
MD5:	285ADD706E818D58486213C030BD9ED5
SHA1:	3593842190DB067FC23F4E3E7A8FC69263800A47
SHA-256:	20B63D70AA9351A7ECC1E8B4A8099BC7D6A4500BA11DE6BCFB028D09475A6D7E
SHA-512:	935832497DF8AD8A4676947C0BCEC89C312753E604B3C2AAAAA42CDF2DFEDD5151385B44589C8E304ABA26D9578DFF1FE841EDE6EB5E784208984584FB8B2201
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Java update.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	507
Entropy (8bit):	5.344008188221104
Encrypted:	false
SSDEEP:	12:Q3La/hz92n4M0kvoDLI4MWuCqDLI4MWuPTAq1KDLI4M6:MLU84jE4K5E4KH1qE4j
MD5:	285ADD706E818D58486213C030BD9ED5
SHA1:	3593842190DB067FC23F4E3E7A8FC69263800A47
SHA-256:	20B63D70AA9351A7ECC1E8B4A8099BC7D6A4500BA11DE6BCFB028D09475A6D7E
SHA-512:	935832497DF8AD8A4676947C0BCEC89C312753E604B3C2AAAAA42CDF2DFEDD5151385B44589C8E304ABA26D9578DFF1FE841EDE6EB5E784208984584FB8B2201
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Server.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\Server.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	507
Entropy (8bit):	5.344008188221104
Encrypted:	false
SSDEEP:	12:Q3La/hz92n4M0kvoDLI4MWuCqDLI4MWuPTAq1KDLI4M6:MLU84jE4K5E4KH1qE4j
MD5:	285ADD706E818D58486213C030BD9ED5
SHA1:	3593842190DB067FC23F4E3E7A8FC69263800A47
SHA-256:	20B63D70AA9351A7ECC1E8B4A8099BC7D6A4500BA11DE6BCFB028D09475A6D7E
SHA-512:	935832497DF8AD8A4676947C0BCEC89C312753E604B3C2AAAAA42CDF2DFEDD5151385B44589C8E304ABA26D9578DFF1FE841EDE6EB5E784208984584FB8B2201
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\oiA5KmV0f0.exe.log

Download File

Process:	C:\Users\user\Desktop\oiA5KmV0f0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	507
Entropy (8bit):	5.344008188221104
Encrypted:	false
SSDEEP:	12:Q3La/hz92n4M9tDLI4MWuPTArkvoDLI4MWuCq1KDLI4M6:MLU84qpE4KiE4Kx1qE4j
MD5:	E3AE66893ABAEBF0E42453B05BA9BEFB
SHA1:	4F39F0BD9B04CFD4EB4A1658EFF69FF0828E8B08
SHA-256:	314945D1C8D3D184DB02752906200184ECECF31B05307CC8C2603BFE63585E8C
SHA-512:	54F24653AE3A4F73E3636609312B2F5F305009EA2FE8D3495CED2E1108434801FD4E0B9C2E6B6C91AD8B7003C41490D7EF3BBBD99D4C26A6A6E9AC4D3E1D0992
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Temp\Server.exe

Download File

Process:	C:\Users\user\AppData\Roaming\Dllhost.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	44032
Entropy (8bit):	5.607323333252346
Encrypted:	false
SSDEEP:	384:HZyGdElQ5GoyyBrlr0DiEuEe83H/zIIij+ZsNO3PlpJKkkjh/TzF7pWnI/greT0k:5gmolyBr907NRuXQ/o1/+L
MD5:	1917739297383BB37D4F159E8540B70B
SHA1:	12447834E3CE0745F5756F492AEE4487C6C1CEF4
SHA-256:	431E12F989DD7A4C9D8235F4FA9F3E026A4B55921AA2FB4942563F857681F06C
SHA-512:	7C8B032480DD4E9D972ECEB1E1DC354CE5BE2C66D777A12A45E267220E5AB601CBFC95D724379A903F59CDC39265A2E62E3D1A9FA66FBE4D8D71C0FA736489C5
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Local\Temp\Server.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\Server.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Local\Temp\Server.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Local\Temp\Server.exe, Author: JPCERT/CC Incident Response Group
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 86% Antivirus: Virustotal, Detection: 83%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Kmg................................. ........@.. ....................... ............@.................................@...K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................p.......H.......@y...J......T....x................................................(......(.....s.........s.........s.........s.........s..........0..........~....o......0..........~....o......0..........~....o......0..........~....o......0..........~....o......0................,.........o....9....~....,,~.........(....o...., r...p......(....s....zs.........~.........(.....o....(...+..lu....%-.&.+.%.(.....o...............&r;..p..........o....o......(.......o....s....z~........

C:\Users\user\AppData\Roaming\Dllhost.exe

Download File

Process:	C:\Users\user\Desktop\oiA5KmV0f0.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	44032
Entropy (8bit):	5.607323333252346
Encrypted:	false
SSDEEP:	384:HZyGdElQ5GoyyBrlr0DiEuEe83H/zIIij+ZsNO3PlpJKkkjh/TzF7pWnI/greT0k:5gmolyBr907NRuXQ/o1/+L
MD5:	1917739297383BB37D4F159E8540B70B
SHA1:	12447834E3CE0745F5756F492AEE4487C6C1CEF4
SHA-256:	431E12F989DD7A4C9D8235F4FA9F3E026A4B55921AA2FB4942563F857681F06C
SHA-512:	7C8B032480DD4E9D972ECEB1E1DC354CE5BE2C66D777A12A45E267220E5AB601CBFC95D724379A903F59CDC39265A2E62E3D1A9FA66FBE4D8D71C0FA736489C5
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Dllhost.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Dllhost.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\Dllhost.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Dllhost.exe, Author: JPCERT/CC Incident Response Group
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 86% Antivirus: Virustotal, Detection: 83%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Kmg................................. ........@.. ....................... ............@.................................@...K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................p.......H.......@y...J......T....x................................................(......(.....s.........s.........s.........s.........s..........0..........~....o......0..........~....o......0..........~....o......0..........~....o......0..........~....o......0................,.........o....9....~....,,~.........(....o...., r...p......(....s....zs.........~.........(.....o....(...+..lu....%-.&.+.%.(.....o...............&r;..p..........o....o......(.......o....s....z~........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe

Download File

Process:	C:\Users\user\AppData\Roaming\Dllhost.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	44032
Entropy (8bit):	5.607323333252346
Encrypted:	false
SSDEEP:	384:HZyGdElQ5GoyyBrlr0DiEuEe83H/zIIij+ZsNO3PlpJKkkjh/TzF7pWnI/greT0k:5gmolyBr907NRuXQ/o1/+L
MD5:	1917739297383BB37D4F159E8540B70B
SHA1:	12447834E3CE0745F5756F492AEE4487C6C1CEF4
SHA-256:	431E12F989DD7A4C9D8235F4FA9F3E026A4B55921AA2FB4942563F857681F06C
SHA-512:	7C8B032480DD4E9D972ECEB1E1DC354CE5BE2C66D777A12A45E267220E5AB601CBFC95D724379A903F59CDC39265A2E62E3D1A9FA66FBE4D8D71C0FA736489C5
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, Author: JPCERT/CC Incident Response Group
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 86% Antivirus: Virustotal, Detection: 83%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Kmg................................. ........@.. ....................... ............@.................................@...K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................p.......H.......@y...J......T....x................................................(......(.....s.........s.........s.........s.........s..........0..........~....o......0..........~....o......0..........~....o......0..........~....o......0..........~....o......0................,.........o....9....~....,,~.........(....o...., r...p......(....s....zs.........~.........(.....o....(...+..lu....%-.&.+.%.(.....o...............&r;..p..........o....o......(.......o....s....z~........

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.607323333252346
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	oiA5KmV0f0.exe
File size:	44'032 bytes
MD5:	1917739297383bb37d4f159e8540b70b
SHA1:	12447834e3ce0745f5756f492aee4487c6c1cef4
SHA256:	431e12f989dd7a4c9d8235f4fa9f3e026a4b55921aa2fb4942563f857681f06c
SHA512:	7c8b032480dd4e9d972eceb1e1dc354ce5be2c66d777a12a45e267220e5ab601cbfc95d724379a903f59cdc39265a2e62e3d1a9fa66fbe4d8d71c0fa736489c5
SSDEEP:	384:HZyGdElQ5GoyyBrlr0DiEuEe83H/zIIij+ZsNO3PlpJKkkjh/TzF7pWnI/greT0k:5gmolyBr907NRuXQ/o1/+L
TLSH:	9F13E74CB694E174D5FF8BF1B4A2B2890B71A01BA806D30F99F154D94B73EC09A11EE7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Kmg................................. ........@.. ....................... ............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x40c38e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x676D4B8F [Thu Dec 26 12:26:55 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc340	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe000	0x400	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x10000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa394	0xa400	807f8931422bacb3a148e82ebd9235f6	False	0.4204220655487805	data	5.700422014949752	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xe000	0x400	0x400	e6bddab8cfc5a0b85c6b2404ef045c60	False	0.3017578125	data	3.5160679793070893	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x10000	0xc	0x200	7944e824d98cd140be139d8516798e9a	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0xe058	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50068	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50063	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50067	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49838	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50071	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50061	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49736	3.126.37.18	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49884	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50072	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49896	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49910	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50080	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49890	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49920	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49926	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50076	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49743	3.126.37.18	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49749	3.126.37.18	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49950	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50084	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49741	3.126.37.18	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49782	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50013	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50065	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49938	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50058	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49932	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50082	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49969	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49866	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49981	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50057	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49744	3.126.37.18	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49739	3.126.37.18	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49845	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49872	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50074	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50079	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49988	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49987	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49956	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50024	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49760	3.126.37.18	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50083	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49730	3.126.37.18	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49975	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50059	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49852	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49904	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49878	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49964	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49740	3.126.37.18	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49745	3.126.37.18	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50007	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50000	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49830	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49801	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50077	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50085	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50004	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49746	3.126.37.18	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50078	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50070	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50060	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50019	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49771	3.126.37.18	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50064	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50066	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49962	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49860	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50062	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49732	3.126.37.18	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49914	18.156.13.209	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50081	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50073	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50075	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50069	18.192.93.86	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49944	18.197.239.5	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49742	3.126.37.18	11048	TCP
2024-12-28T21:06:58.680525+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49994	18.197.239.5	11048	TCP
2024-12-28T21:07:09.834020+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49730	3.126.37.18	11048	TCP
2024-12-28T21:07:09.834020+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49730	3.126.37.18	11048	TCP
2024-12-28T21:07:09.834020+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49730	3.126.37.18	11048	TCP
2024-12-28T21:07:09.834020+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49730	3.126.37.18	11048	TCP
2024-12-28T21:07:09.953895+0100	2825563	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf)	1	192.168.2.4	49730	3.126.37.18	11048	TCP
2024-12-28T21:07:09.953895+0100	2838486	ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf)	1	192.168.2.4	49730	3.126.37.18	11048	TCP
2024-12-28T21:07:13.943806+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49732	3.126.37.18	11048	TCP
2024-12-28T21:07:13.943806+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49732	3.126.37.18	11048	TCP
2024-12-28T21:07:13.943806+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49732	3.126.37.18	11048	TCP
2024-12-28T21:07:13.943806+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49732	3.126.37.18	11048	TCP
2024-12-28T21:07:14.063413+0100	2825563	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf)	1	192.168.2.4	49732	3.126.37.18	11048	TCP
2024-12-28T21:07:14.063413+0100	2838486	ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf)	1	192.168.2.4	49732	3.126.37.18	11048	TCP
2024-12-28T21:07:15.603959+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49732	3.126.37.18	11048	TCP
2024-12-28T21:07:18.426111+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49736	3.126.37.18	11048	TCP
2024-12-28T21:07:18.426111+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49736	3.126.37.18	11048	TCP
2024-12-28T21:07:18.426111+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49736	3.126.37.18	11048	TCP
2024-12-28T21:07:18.426111+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49736	3.126.37.18	11048	TCP
2024-12-28T21:07:18.545663+0100	2825563	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf)	1	192.168.2.4	49736	3.126.37.18	11048	TCP
2024-12-28T21:07:18.545663+0100	2838486	ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf)	1	192.168.2.4	49736	3.126.37.18	11048	TCP
2024-12-28T21:07:23.275795+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49739	3.126.37.18	11048	TCP
2024-12-28T21:07:23.275795+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49739	3.126.37.18	11048	TCP
2024-12-28T21:07:23.275795+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49739	3.126.37.18	11048	TCP
2024-12-28T21:07:23.275795+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49739	3.126.37.18	11048	TCP
2024-12-28T21:07:23.395539+0100	2825563	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf)	1	192.168.2.4	49739	3.126.37.18	11048	TCP
2024-12-28T21:07:23.395539+0100	2838486	ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf)	1	192.168.2.4	49739	3.126.37.18	11048	TCP
2024-12-28T21:07:24.114969+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49739	3.126.37.18	11048	TCP
2024-12-28T21:07:26.936209+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49740	3.126.37.18	11048	TCP
2024-12-28T21:07:26.936209+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49740	3.126.37.18	11048	TCP
2024-12-28T21:07:26.936209+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49740	3.126.37.18	11048	TCP
2024-12-28T21:07:26.936209+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49740	3.126.37.18	11048	TCP
2024-12-28T21:07:27.055994+0100	2825563	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf)	1	192.168.2.4	49740	3.126.37.18	11048	TCP
2024-12-28T21:07:27.055994+0100	2838486	ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf)	1	192.168.2.4	49740	3.126.37.18	11048	TCP
2024-12-28T21:07:31.869895+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49741	3.126.37.18	11048	TCP
2024-12-28T21:07:31.869895+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49741	3.126.37.18	11048	TCP
2024-12-28T21:07:31.869895+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49741	3.126.37.18	11048	TCP
2024-12-28T21:07:31.869895+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49741	3.126.37.18	11048	TCP
2024-12-28T21:07:31.989706+0100	2825563	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf)	1	192.168.2.4	49741	3.126.37.18	11048	TCP
2024-12-28T21:07:31.989706+0100	2838486	ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf)	1	192.168.2.4	49741	3.126.37.18	11048	TCP
2024-12-28T21:07:32.429888+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49741	3.126.37.18	11048	TCP
2024-12-28T21:07:35.721422+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49742	3.126.37.18	11048	TCP
2024-12-28T21:07:35.721422+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49742	3.126.37.18	11048	TCP
2024-12-28T21:07:35.721422+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49742	3.126.37.18	11048	TCP
2024-12-28T21:07:35.721422+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49742	3.126.37.18	11048	TCP
2024-12-28T21:07:35.841117+0100	2825563	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf)	1	192.168.2.4	49742	3.126.37.18	11048	TCP
2024-12-28T21:07:35.841117+0100	2838486	ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf)	1	192.168.2.4	49742	3.126.37.18	11048	TCP
2024-12-28T21:07:41.161965+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49743	3.126.37.18	11048	TCP
2024-12-28T21:07:41.161965+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49743	3.126.37.18	11048	TCP
2024-12-28T21:07:41.161965+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49743	3.126.37.18	11048	TCP
2024-12-28T21:07:41.161965+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49743	3.126.37.18	11048	TCP
2024-12-28T21:07:44.533732+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49744	3.126.37.18	11048	TCP
2024-12-28T21:07:44.533732+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49744	3.126.37.18	11048	TCP
2024-12-28T21:07:44.533732+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49744	3.126.37.18	11048	TCP
2024-12-28T21:07:44.533732+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49744	3.126.37.18	11048	TCP
2024-12-28T21:07:44.653576+0100	2825563	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf)	1	192.168.2.4	49744	3.126.37.18	11048	TCP
2024-12-28T21:07:44.653576+0100	2838486	ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf)	1	192.168.2.4	49744	3.126.37.18	11048	TCP
2024-12-28T21:07:50.148764+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49745	3.126.37.18	11048	TCP
2024-12-28T21:07:50.148764+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49745	3.126.37.18	11048	TCP
2024-12-28T21:07:50.148764+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49745	3.126.37.18	11048	TCP
2024-12-28T21:07:50.148764+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49745	3.126.37.18	11048	TCP
2024-12-28T21:07:50.268538+0100	2825563	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf)	1	192.168.2.4	49745	3.126.37.18	11048	TCP
2024-12-28T21:07:50.268538+0100	2838486	ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf)	1	192.168.2.4	49745	3.126.37.18	11048	TCP
2024-12-28T21:07:53.239659+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49746	3.126.37.18	11048	TCP
2024-12-28T21:07:53.239659+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49746	3.126.37.18	11048	TCP
2024-12-28T21:07:53.239659+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49746	3.126.37.18	11048	TCP
2024-12-28T21:07:53.239659+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49746	3.126.37.18	11048	TCP
2024-12-28T21:07:53.359614+0100	2825563	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf)	1	192.168.2.4	49746	3.126.37.18	11048	TCP
2024-12-28T21:07:53.359614+0100	2838486	ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf)	1	192.168.2.4	49746	3.126.37.18	11048	TCP
2024-12-28T21:07:53.806095+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49746	3.126.37.18	11048	TCP
2024-12-28T21:07:57.847206+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49749	3.126.37.18	11048	TCP
2024-12-28T21:07:57.847206+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49749	3.126.37.18	11048	TCP
2024-12-28T21:07:57.847206+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49749	3.126.37.18	11048	TCP
2024-12-28T21:07:57.847206+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49749	3.126.37.18	11048	TCP
2024-12-28T21:07:57.967015+0100	2825563	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf)	1	192.168.2.4	49749	3.126.37.18	11048	TCP
2024-12-28T21:07:57.967015+0100	2838486	ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf)	1	192.168.2.4	49749	3.126.37.18	11048	TCP
2024-12-28T21:07:58.087104+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49749	3.126.37.18	11048	TCP
2024-12-28T21:08:02.113256+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49760	3.126.37.18	11048	TCP
2024-12-28T21:08:02.113256+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49760	3.126.37.18	11048	TCP
2024-12-28T21:08:02.113256+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49760	3.126.37.18	11048	TCP
2024-12-28T21:08:02.113256+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49760	3.126.37.18	11048	TCP
2024-12-28T21:08:02.233313+0100	2825563	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf)	1	192.168.2.4	49760	3.126.37.18	11048	TCP
2024-12-28T21:08:02.233313+0100	2838486	ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf)	1	192.168.2.4	49760	3.126.37.18	11048	TCP
2024-12-28T21:08:03.634253+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49760	3.126.37.18	11048	TCP
2024-12-28T21:08:06.584971+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49771	3.126.37.18	11048	TCP
2024-12-28T21:08:06.584971+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49771	3.126.37.18	11048	TCP
2024-12-28T21:08:06.584971+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49771	3.126.37.18	11048	TCP
2024-12-28T21:08:06.584971+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49771	3.126.37.18	11048	TCP
2024-12-28T21:08:06.704875+0100	2825563	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf)	1	192.168.2.4	49771	3.126.37.18	11048	TCP
2024-12-28T21:08:06.704875+0100	2838486	ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf)	1	192.168.2.4	49771	3.126.37.18	11048	TCP
2024-12-28T21:08:07.103079+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49771	3.126.37.18	11048	TCP
2024-12-28T21:08:08.212650+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49771	3.126.37.18	11048	TCP
2024-12-28T21:08:11.018169+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49782	18.156.13.209	11048	TCP
2024-12-28T21:08:11.018169+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49782	18.156.13.209	11048	TCP
2024-12-28T21:08:11.018169+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49782	18.156.13.209	11048	TCP
2024-12-28T21:08:11.018169+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49782	18.156.13.209	11048	TCP
2024-12-28T21:08:11.681647+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49782	18.156.13.209	11048	TCP
2024-12-28T21:08:11.884168+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49782	18.156.13.209	11048	TCP
2024-12-28T21:08:12.932806+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49782	18.156.13.209	11048	TCP
2024-12-28T21:08:13.055838+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49782	18.156.13.209	11048	TCP
2024-12-28T21:08:15.359825+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49791	18.156.13.209	11048	TCP
2024-12-28T21:08:15.359825+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49791	18.156.13.209	11048	TCP
2024-12-28T21:08:15.359825+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49791	18.156.13.209	11048	TCP
2024-12-28T21:08:15.359825+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49791	18.156.13.209	11048	TCP
2024-12-28T21:08:16.207498+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49791	18.156.13.209	11048	TCP
2024-12-28T21:08:16.568653+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49791	18.156.13.209	11048	TCP
2024-12-28T21:08:16.928578+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49791	18.156.13.209	11048	TCP
2024-12-28T21:08:17.048085+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49791	18.156.13.209	11048	TCP
2024-12-28T21:08:17.491259+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49791	18.156.13.209	11048	TCP
2024-12-28T21:08:19.772250+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49801	18.156.13.209	11048	TCP
2024-12-28T21:08:19.772250+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49801	18.156.13.209	11048	TCP
2024-12-28T21:08:19.772250+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49801	18.156.13.209	11048	TCP
2024-12-28T21:08:19.772250+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49801	18.156.13.209	11048	TCP
2024-12-28T21:08:20.013223+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49801	18.156.13.209	11048	TCP
2024-12-28T21:08:20.707341+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49801	18.156.13.209	11048	TCP
2024-12-28T21:08:21.425315+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49801	18.156.13.209	11048	TCP
2024-12-28T21:08:21.665378+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49801	18.156.13.209	11048	TCP
2024-12-28T21:08:21.786368+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49801	18.156.13.209	11048	TCP
2024-12-28T21:08:23.910907+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49812	18.156.13.209	11048	TCP
2024-12-28T21:08:23.910907+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49812	18.156.13.209	11048	TCP
2024-12-28T21:08:23.910907+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49812	18.156.13.209	11048	TCP
2024-12-28T21:08:23.910907+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49812	18.156.13.209	11048	TCP
2024-12-28T21:08:25.111577+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49812	18.156.13.209	11048	TCP
2024-12-28T21:08:25.355251+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49812	18.156.13.209	11048	TCP
2024-12-28T21:08:25.955716+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49812	18.156.13.209	11048	TCP
2024-12-28T21:08:28.058099+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49822	18.156.13.209	11048	TCP
2024-12-28T21:08:28.058099+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49822	18.156.13.209	11048	TCP
2024-12-28T21:08:28.058099+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49822	18.156.13.209	11048	TCP
2024-12-28T21:08:28.058099+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49822	18.156.13.209	11048	TCP
2024-12-28T21:08:28.905509+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49822	18.156.13.209	11048	TCP
2024-12-28T21:08:29.624450+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49822	18.156.13.209	11048	TCP
2024-12-28T21:08:29.770800+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49822	18.156.13.209	11048	TCP
2024-12-28T21:08:29.891210+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49822	18.156.13.209	11048	TCP
2024-12-28T21:08:29.891210+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49822	18.156.13.209	11048	TCP
2024-12-28T21:08:32.045707+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49830	18.156.13.209	11048	TCP
2024-12-28T21:08:32.045707+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49830	18.156.13.209	11048	TCP
2024-12-28T21:08:32.045707+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49830	18.156.13.209	11048	TCP
2024-12-28T21:08:32.045707+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49830	18.156.13.209	11048	TCP
2024-12-28T21:08:32.287230+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49830	18.156.13.209	11048	TCP
2024-12-28T21:08:35.028522+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49838	18.156.13.209	11048	TCP
2024-12-28T21:08:35.028522+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49838	18.156.13.209	11048	TCP
2024-12-28T21:08:35.028522+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49838	18.156.13.209	11048	TCP
2024-12-28T21:08:35.028522+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49838	18.156.13.209	11048	TCP
2024-12-28T21:08:35.509277+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49838	18.156.13.209	11048	TCP
2024-12-28T21:08:36.175638+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49838	18.156.13.209	11048	TCP
2024-12-28T21:08:36.295111+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49838	18.156.13.209	11048	TCP
2024-12-28T21:08:37.998860+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49845	18.156.13.209	11048	TCP
2024-12-28T21:08:37.998860+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49845	18.156.13.209	11048	TCP
2024-12-28T21:08:37.998860+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49845	18.156.13.209	11048	TCP
2024-12-28T21:08:37.998860+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49845	18.156.13.209	11048	TCP
2024-12-28T21:08:38.477257+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49845	18.156.13.209	11048	TCP
2024-12-28T21:08:38.596799+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49845	18.156.13.209	11048	TCP
2024-12-28T21:08:40.839556+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49852	18.156.13.209	11048	TCP
2024-12-28T21:08:40.839556+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49852	18.156.13.209	11048	TCP
2024-12-28T21:08:40.839556+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49852	18.156.13.209	11048	TCP
2024-12-28T21:08:40.839556+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49852	18.156.13.209	11048	TCP
2024-12-28T21:08:43.598925+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49860	18.156.13.209	11048	TCP
2024-12-28T21:08:43.598925+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49860	18.156.13.209	11048	TCP
2024-12-28T21:08:43.598925+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49860	18.156.13.209	11048	TCP
2024-12-28T21:08:43.598925+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49860	18.156.13.209	11048	TCP
2024-12-28T21:08:44.202928+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49860	18.156.13.209	11048	TCP
2024-12-28T21:08:44.325681+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49860	18.156.13.209	11048	TCP
2024-12-28T21:08:46.406182+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49866	18.156.13.209	11048	TCP
2024-12-28T21:08:46.406182+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49866	18.156.13.209	11048	TCP
2024-12-28T21:08:46.406182+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49866	18.156.13.209	11048	TCP
2024-12-28T21:08:46.406182+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49866	18.156.13.209	11048	TCP
2024-12-28T21:08:47.005551+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49866	18.156.13.209	11048	TCP
2024-12-28T21:08:47.380745+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49866	18.156.13.209	11048	TCP
2024-12-28T21:08:47.620176+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49866	18.156.13.209	11048	TCP
2024-12-28T21:08:48.918294+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49872	18.156.13.209	11048	TCP
2024-12-28T21:08:48.918294+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49872	18.156.13.209	11048	TCP
2024-12-28T21:08:48.918294+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49872	18.156.13.209	11048	TCP
2024-12-28T21:08:48.918294+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49872	18.156.13.209	11048	TCP
2024-12-28T21:08:49.521250+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49872	18.156.13.209	11048	TCP
2024-12-28T21:08:49.640949+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49872	18.156.13.209	11048	TCP
2024-12-28T21:08:49.880029+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49872	18.156.13.209	11048	TCP
2024-12-28T21:08:51.549706+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49878	18.156.13.209	11048	TCP
2024-12-28T21:08:51.549706+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49878	18.156.13.209	11048	TCP
2024-12-28T21:08:51.549706+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49878	18.156.13.209	11048	TCP
2024-12-28T21:08:51.549706+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49878	18.156.13.209	11048	TCP
2024-12-28T21:08:51.908721+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49878	18.156.13.209	11048	TCP
2024-12-28T21:08:52.028524+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49878	18.156.13.209	11048	TCP
2024-12-28T21:08:52.509325+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49878	18.156.13.209	11048	TCP
2024-12-28T21:08:54.250997+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49884	18.156.13.209	11048	TCP
2024-12-28T21:08:54.250997+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49884	18.156.13.209	11048	TCP
2024-12-28T21:08:54.250997+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49884	18.156.13.209	11048	TCP
2024-12-28T21:08:54.250997+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49884	18.156.13.209	11048	TCP
2024-12-28T21:08:54.563181+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49884	18.156.13.209	11048	TCP
2024-12-28T21:08:56.322390+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49890	18.156.13.209	11048	TCP
2024-12-28T21:08:56.322390+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49890	18.156.13.209	11048	TCP
2024-12-28T21:08:56.322390+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49890	18.156.13.209	11048	TCP
2024-12-28T21:08:56.322390+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49890	18.156.13.209	11048	TCP
2024-12-28T21:08:56.921621+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49890	18.156.13.209	11048	TCP
2024-12-28T21:08:57.300084+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49890	18.156.13.209	11048	TCP
2024-12-28T21:08:58.707818+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49896	18.156.13.209	11048	TCP
2024-12-28T21:08:58.707818+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49896	18.156.13.209	11048	TCP
2024-12-28T21:08:58.707818+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49896	18.156.13.209	11048	TCP
2024-12-28T21:08:58.707818+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49896	18.156.13.209	11048	TCP
2024-12-28T21:08:59.187453+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49896	18.156.13.209	11048	TCP
2024-12-28T21:08:59.671278+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49896	18.156.13.209	11048	TCP
2024-12-28T21:08:59.792463+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49896	18.156.13.209	11048	TCP
2024-12-28T21:09:01.031542+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49904	18.156.13.209	11048	TCP
2024-12-28T21:09:01.031542+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49904	18.156.13.209	11048	TCP
2024-12-28T21:09:01.031542+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49904	18.156.13.209	11048	TCP
2024-12-28T21:09:01.031542+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49904	18.156.13.209	11048	TCP
2024-12-28T21:09:01.872596+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49904	18.156.13.209	11048	TCP
2024-12-28T21:09:02.236921+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49904	18.156.13.209	11048	TCP
2024-12-28T21:09:02.357861+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49904	18.156.13.209	11048	TCP
2024-12-28T21:09:03.299990+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49910	18.156.13.209	11048	TCP
2024-12-28T21:09:03.299990+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49910	18.156.13.209	11048	TCP
2024-12-28T21:09:03.299990+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49910	18.156.13.209	11048	TCP
2024-12-28T21:09:03.299990+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49910	18.156.13.209	11048	TCP
2024-12-28T21:09:03.902169+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49910	18.156.13.209	11048	TCP
2024-12-28T21:09:04.270455+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49910	18.156.13.209	11048	TCP
2024-12-28T21:09:05.507174+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49914	18.156.13.209	11048	TCP
2024-12-28T21:09:05.507174+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49914	18.156.13.209	11048	TCP
2024-12-28T21:09:05.507174+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49914	18.156.13.209	11048	TCP
2024-12-28T21:09:05.507174+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49914	18.156.13.209	11048	TCP
2024-12-28T21:09:06.228876+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49914	18.156.13.209	11048	TCP
2024-12-28T21:09:06.355666+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49914	18.156.13.209	11048	TCP
2024-12-28T21:09:06.715549+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49914	18.156.13.209	11048	TCP
2024-12-28T21:09:07.571962+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49920	18.156.13.209	11048	TCP
2024-12-28T21:09:07.571962+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49920	18.156.13.209	11048	TCP
2024-12-28T21:09:07.571962+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49920	18.156.13.209	11048	TCP
2024-12-28T21:09:07.571962+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49920	18.156.13.209	11048	TCP
2024-12-28T21:09:07.936078+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49920	18.156.13.209	11048	TCP
2024-12-28T21:09:08.416824+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49920	18.156.13.209	11048	TCP
2024-12-28T21:09:09.673016+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49926	18.156.13.209	11048	TCP
2024-12-28T21:09:09.673016+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49926	18.156.13.209	11048	TCP
2024-12-28T21:09:09.673016+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49926	18.156.13.209	11048	TCP
2024-12-28T21:09:09.673016+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49926	18.156.13.209	11048	TCP
2024-12-28T21:09:10.272292+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49926	18.156.13.209	11048	TCP
2024-12-28T21:09:10.392131+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49926	18.156.13.209	11048	TCP
2024-12-28T21:09:10.511739+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49926	18.156.13.209	11048	TCP
2024-12-28T21:09:11.927094+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49932	18.197.239.5	11048	TCP
2024-12-28T21:09:11.927094+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49932	18.197.239.5	11048	TCP
2024-12-28T21:09:11.927094+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49932	18.197.239.5	11048	TCP
2024-12-28T21:09:11.927094+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49932	18.197.239.5	11048	TCP
2024-12-28T21:09:12.285846+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49932	18.197.239.5	11048	TCP
2024-12-28T21:09:12.411414+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49932	18.197.239.5	11048	TCP
2024-12-28T21:09:12.898340+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49932	18.197.239.5	11048	TCP
2024-12-28T21:09:14.069397+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49938	18.197.239.5	11048	TCP
2024-12-28T21:09:14.069397+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49938	18.197.239.5	11048	TCP
2024-12-28T21:09:14.069397+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49938	18.197.239.5	11048	TCP
2024-12-28T21:09:14.069397+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49938	18.197.239.5	11048	TCP
2024-12-28T21:09:14.308836+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49938	18.197.239.5	11048	TCP
2024-12-28T21:09:14.428684+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49938	18.197.239.5	11048	TCP
2024-12-28T21:09:14.917344+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49938	18.197.239.5	11048	TCP
2024-12-28T21:09:16.358429+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49944	18.197.239.5	11048	TCP
2024-12-28T21:09:16.358429+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49944	18.197.239.5	11048	TCP
2024-12-28T21:09:16.358429+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49944	18.197.239.5	11048	TCP
2024-12-28T21:09:16.358429+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49944	18.197.239.5	11048	TCP
2024-12-28T21:09:16.597798+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49944	18.197.239.5	11048	TCP
2024-12-28T21:09:16.717383+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49944	18.197.239.5	11048	TCP
2024-12-28T21:09:16.836877+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49944	18.197.239.5	11048	TCP
2024-12-28T21:09:17.971531+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49950	18.197.239.5	11048	TCP
2024-12-28T21:09:17.971531+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49950	18.197.239.5	11048	TCP
2024-12-28T21:09:17.971531+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49950	18.197.239.5	11048	TCP
2024-12-28T21:09:17.971531+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49950	18.197.239.5	11048	TCP
2024-12-28T21:09:18.331182+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49950	18.197.239.5	11048	TCP
2024-12-28T21:09:19.105678+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49950	18.197.239.5	11048	TCP
2024-12-28T21:09:19.853666+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49956	18.197.239.5	11048	TCP
2024-12-28T21:09:19.853666+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49956	18.197.239.5	11048	TCP
2024-12-28T21:09:19.853666+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49956	18.197.239.5	11048	TCP
2024-12-28T21:09:19.853666+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49956	18.197.239.5	11048	TCP
2024-12-28T21:09:20.267033+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49956	18.197.239.5	11048	TCP
2024-12-28T21:09:21.814418+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49962	18.197.239.5	11048	TCP
2024-12-28T21:09:21.814418+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49962	18.197.239.5	11048	TCP
2024-12-28T21:09:21.814418+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49962	18.197.239.5	11048	TCP
2024-12-28T21:09:21.814418+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49962	18.197.239.5	11048	TCP
2024-12-28T21:09:22.055226+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49962	18.197.239.5	11048	TCP
2024-12-28T21:09:22.534297+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49962	18.197.239.5	11048	TCP
2024-12-28T21:09:22.897972+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49962	18.197.239.5	11048	TCP
2024-12-28T21:09:23.017539+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49962	18.197.239.5	11048	TCP
2024-12-28T21:09:23.693332+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49964	18.197.239.5	11048	TCP
2024-12-28T21:09:23.693332+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49964	18.197.239.5	11048	TCP
2024-12-28T21:09:23.693332+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49964	18.197.239.5	11048	TCP
2024-12-28T21:09:23.693332+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49964	18.197.239.5	11048	TCP
2024-12-28T21:09:24.175142+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49964	18.197.239.5	11048	TCP
2024-12-28T21:09:25.681224+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49969	18.197.239.5	11048	TCP
2024-12-28T21:09:25.681224+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49969	18.197.239.5	11048	TCP
2024-12-28T21:09:25.681224+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49969	18.197.239.5	11048	TCP
2024-12-28T21:09:25.681224+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49969	18.197.239.5	11048	TCP
2024-12-28T21:09:26.159736+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49969	18.197.239.5	11048	TCP
2024-12-28T21:09:26.279329+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49969	18.197.239.5	11048	TCP
2024-12-28T21:09:26.399129+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49969	18.197.239.5	11048	TCP
2024-12-28T21:09:26.667738+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49969	18.197.239.5	11048	TCP
2024-12-28T21:09:27.503838+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49975	18.197.239.5	11048	TCP
2024-12-28T21:09:27.503838+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49975	18.197.239.5	11048	TCP
2024-12-28T21:09:27.503838+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49975	18.197.239.5	11048	TCP
2024-12-28T21:09:27.503838+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49975	18.197.239.5	11048	TCP
2024-12-28T21:09:27.862494+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49975	18.197.239.5	11048	TCP
2024-12-28T21:09:28.460753+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49975	18.197.239.5	11048	TCP
2024-12-28T21:09:29.283727+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49981	18.197.239.5	11048	TCP
2024-12-28T21:09:29.283727+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49981	18.197.239.5	11048	TCP
2024-12-28T21:09:29.283727+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49981	18.197.239.5	11048	TCP
2024-12-28T21:09:29.283727+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49981	18.197.239.5	11048	TCP
2024-12-28T21:09:30.005351+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49981	18.197.239.5	11048	TCP
2024-12-28T21:09:30.211236+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49981	18.197.239.5	11048	TCP
2024-12-28T21:09:30.330785+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49981	18.197.239.5	11048	TCP
2024-12-28T21:09:30.450264+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49981	18.197.239.5	11048	TCP
2024-12-28T21:09:30.569831+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49981	18.197.239.5	11048	TCP
2024-12-28T21:09:31.160289+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49987	18.197.239.5	11048	TCP
2024-12-28T21:09:31.160289+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49987	18.197.239.5	11048	TCP
2024-12-28T21:09:31.160289+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49987	18.197.239.5	11048	TCP
2024-12-28T21:09:31.160289+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49987	18.197.239.5	11048	TCP
2024-12-28T21:09:32.125104+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49987	18.197.239.5	11048	TCP
2024-12-28T21:09:32.244676+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49987	18.197.239.5	11048	TCP
2024-12-28T21:09:32.365373+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49987	18.197.239.5	11048	TCP
2024-12-28T21:09:33.219478+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49988	18.197.239.5	11048	TCP
2024-12-28T21:09:33.219478+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49988	18.197.239.5	11048	TCP
2024-12-28T21:09:33.219478+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49988	18.197.239.5	11048	TCP
2024-12-28T21:09:33.219478+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49988	18.197.239.5	11048	TCP
2024-12-28T21:09:34.706032+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49994	18.197.239.5	11048	TCP
2024-12-28T21:09:34.706032+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49994	18.197.239.5	11048	TCP
2024-12-28T21:09:34.706032+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	49994	18.197.239.5	11048	TCP
2024-12-28T21:09:34.706032+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	49994	18.197.239.5	11048	TCP
2024-12-28T21:09:35.193578+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49994	18.197.239.5	11048	TCP
2024-12-28T21:09:35.920593+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49994	18.197.239.5	11048	TCP
2024-12-28T21:09:36.494680+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50000	18.197.239.5	11048	TCP
2024-12-28T21:09:36.494680+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50000	18.197.239.5	11048	TCP
2024-12-28T21:09:36.494680+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50000	18.197.239.5	11048	TCP
2024-12-28T21:09:36.494680+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50000	18.197.239.5	11048	TCP
2024-12-28T21:09:36.734534+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50000	18.197.239.5	11048	TCP
2024-12-28T21:09:36.858310+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50000	18.197.239.5	11048	TCP
2024-12-28T21:09:36.981380+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50000	18.197.239.5	11048	TCP
2024-12-28T21:09:38.202245+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50004	18.197.239.5	11048	TCP
2024-12-28T21:09:38.202245+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50004	18.197.239.5	11048	TCP
2024-12-28T21:09:38.202245+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50004	18.197.239.5	11048	TCP
2024-12-28T21:09:38.202245+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50004	18.197.239.5	11048	TCP
2024-12-28T21:09:38.686317+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50004	18.197.239.5	11048	TCP
2024-12-28T21:09:39.050810+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50004	18.197.239.5	11048	TCP
2024-12-28T21:09:39.295408+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50004	18.197.239.5	11048	TCP
2024-12-28T21:09:39.860100+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50007	18.197.239.5	11048	TCP
2024-12-28T21:09:39.860100+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50007	18.197.239.5	11048	TCP
2024-12-28T21:09:39.860100+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50007	18.197.239.5	11048	TCP
2024-12-28T21:09:39.860100+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50007	18.197.239.5	11048	TCP
2024-12-28T21:09:40.817693+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50007	18.197.239.5	11048	TCP
2024-12-28T21:09:40.937655+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50007	18.197.239.5	11048	TCP
2024-12-28T21:09:41.610632+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50013	18.197.239.5	11048	TCP
2024-12-28T21:09:41.610632+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50013	18.197.239.5	11048	TCP
2024-12-28T21:09:41.610632+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50013	18.197.239.5	11048	TCP
2024-12-28T21:09:41.610632+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50013	18.197.239.5	11048	TCP
2024-12-28T21:09:41.969975+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50013	18.197.239.5	11048	TCP
2024-12-28T21:09:42.089653+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50013	18.197.239.5	11048	TCP
2024-12-28T21:09:42.209268+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50013	18.197.239.5	11048	TCP
2024-12-28T21:09:42.695216+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50013	18.197.239.5	11048	TCP
2024-12-28T21:09:42.814871+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50013	18.197.239.5	11048	TCP
2024-12-28T21:09:43.406959+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50019	18.197.239.5	11048	TCP
2024-12-28T21:09:43.406959+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50019	18.197.239.5	11048	TCP
2024-12-28T21:09:43.406959+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50019	18.197.239.5	11048	TCP
2024-12-28T21:09:43.406959+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50019	18.197.239.5	11048	TCP
2024-12-28T21:09:43.886408+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50019	18.197.239.5	11048	TCP
2024-12-28T21:09:44.613164+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50019	18.197.239.5	11048	TCP
2024-12-28T21:09:45.013924+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50024	18.197.239.5	11048	TCP
2024-12-28T21:09:45.013924+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50024	18.197.239.5	11048	TCP
2024-12-28T21:09:45.013924+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50024	18.197.239.5	11048	TCP
2024-12-28T21:09:45.013924+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50024	18.197.239.5	11048	TCP
2024-12-28T21:09:45.406194+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50024	18.197.239.5	11048	TCP
2024-12-28T21:09:46.125420+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50024	18.197.239.5	11048	TCP
2024-12-28T21:09:46.246397+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50024	18.197.239.5	11048	TCP
2024-12-28T21:09:46.712684+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:46.712684+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:46.712684+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:46.712684+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:47.075090+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:47.317390+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:47.437530+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:47.583008+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:47.703346+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:47.942538+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:48.062305+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:48.301594+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:49.147100+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:49.267020+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:49.631542+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:50.110802+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:50.470393+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:51.203388+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:51.686326+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:51.806102+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:51.926208+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:53.011392+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:53.131039+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:53.734417+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:54.213578+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:54.334099+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:55.055065+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:55.536412+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:56.255059+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:56.980261+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:57.100346+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:57.721026+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:58.429656+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:58.622326+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:59.186210+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:09:59.306013+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:00.468305+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:00.711453+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:01.071426+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:01.467691+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:01.589596+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:02.114700+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:02.473999+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:02.593572+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:02.713461+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:03.799484+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:04.158654+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:04.278578+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:04.775310+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:05.290917+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:05.530273+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:05.771139+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50026	18.197.239.5	11048	TCP
2024-12-28T21:10:06.095866+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50057	18.197.239.5	11048	TCP
2024-12-28T21:10:06.095866+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50057	18.197.239.5	11048	TCP
2024-12-28T21:10:06.095866+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50057	18.197.239.5	11048	TCP
2024-12-28T21:10:06.095866+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50057	18.197.239.5	11048	TCP
2024-12-28T21:10:06.925354+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50057	18.197.239.5	11048	TCP
2024-12-28T21:10:07.166015+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50057	18.197.239.5	11048	TCP
2024-12-28T21:10:08.124154+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50057	18.197.239.5	11048	TCP
2024-12-28T21:10:08.756066+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50058	18.197.239.5	11048	TCP
2024-12-28T21:10:08.756066+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50058	18.197.239.5	11048	TCP
2024-12-28T21:10:08.756066+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50058	18.197.239.5	11048	TCP
2024-12-28T21:10:08.756066+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50058	18.197.239.5	11048	TCP
2024-12-28T21:10:08.997467+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50058	18.197.239.5	11048	TCP
2024-12-28T21:10:09.599442+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50058	18.197.239.5	11048	TCP
2024-12-28T21:10:09.720503+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50058	18.197.239.5	11048	TCP
2024-12-28T21:10:11.120478+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50059	18.197.239.5	11048	TCP
2024-12-28T21:10:11.120478+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50059	18.197.239.5	11048	TCP
2024-12-28T21:10:11.120478+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50059	18.197.239.5	11048	TCP
2024-12-28T21:10:11.120478+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50059	18.197.239.5	11048	TCP
2024-12-28T21:10:11.599504+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50059	18.197.239.5	11048	TCP
2024-12-28T21:10:11.839087+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50059	18.197.239.5	11048	TCP
2024-12-28T21:10:14.064612+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50060	18.192.93.86	11048	TCP
2024-12-28T21:10:14.064612+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50060	18.192.93.86	11048	TCP
2024-12-28T21:10:14.064612+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50060	18.192.93.86	11048	TCP
2024-12-28T21:10:14.064612+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50060	18.192.93.86	11048	TCP
2024-12-28T21:10:14.543337+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50060	18.192.93.86	11048	TCP
2024-12-28T21:10:14.663981+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50060	18.192.93.86	11048	TCP
2024-12-28T21:10:15.534161+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50060	18.192.93.86	11048	TCP
2024-12-28T21:10:15.657604+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50060	18.192.93.86	11048	TCP
2024-12-28T21:10:15.777339+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50060	18.192.93.86	11048	TCP
2024-12-28T21:10:15.897119+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50060	18.192.93.86	11048	TCP
2024-12-28T21:10:16.016897+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50060	18.192.93.86	11048	TCP
2024-12-28T21:10:16.337427+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50060	18.192.93.86	11048	TCP
2024-12-28T21:10:16.496582+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50061	18.192.93.86	11048	TCP
2024-12-28T21:10:16.496582+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50061	18.192.93.86	11048	TCP
2024-12-28T21:10:16.496582+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50061	18.192.93.86	11048	TCP
2024-12-28T21:10:16.496582+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50061	18.192.93.86	11048	TCP
2024-12-28T21:10:16.736216+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50061	18.192.93.86	11048	TCP
2024-12-28T21:10:17.575856+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50061	18.192.93.86	11048	TCP
2024-12-28T21:10:17.819595+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50061	18.192.93.86	11048	TCP
2024-12-28T21:10:18.429989+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50061	18.192.93.86	11048	TCP
2024-12-28T21:10:18.670665+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50061	18.192.93.86	11048	TCP
2024-12-28T21:10:18.997271+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50062	18.192.93.86	11048	TCP
2024-12-28T21:10:18.997271+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50062	18.192.93.86	11048	TCP
2024-12-28T21:10:18.997271+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50062	18.192.93.86	11048	TCP
2024-12-28T21:10:18.997271+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50062	18.192.93.86	11048	TCP
2024-12-28T21:10:19.237340+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50062	18.192.93.86	11048	TCP
2024-12-28T21:10:19.411149+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50062	18.192.93.86	11048	TCP
2024-12-28T21:10:19.651051+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50062	18.192.93.86	11048	TCP
2024-12-28T21:10:20.499418+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50062	18.192.93.86	11048	TCP
2024-12-28T21:10:20.739213+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50062	18.192.93.86	11048	TCP
2024-12-28T21:10:21.380181+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50063	18.192.93.86	11048	TCP
2024-12-28T21:10:21.380181+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50063	18.192.93.86	11048	TCP
2024-12-28T21:10:21.380181+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50063	18.192.93.86	11048	TCP
2024-12-28T21:10:21.380181+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50063	18.192.93.86	11048	TCP
2024-12-28T21:10:21.740019+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50063	18.192.93.86	11048	TCP
2024-12-28T21:10:21.860800+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50063	18.192.93.86	11048	TCP
2024-12-28T21:10:22.460034+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50063	18.192.93.86	11048	TCP
2024-12-28T21:10:23.061398+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50063	18.192.93.86	11048	TCP
2024-12-28T21:10:23.181078+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50063	18.192.93.86	11048	TCP
2024-12-28T21:10:23.833271+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50064	18.192.93.86	11048	TCP
2024-12-28T21:10:23.833271+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50064	18.192.93.86	11048	TCP
2024-12-28T21:10:23.833271+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50064	18.192.93.86	11048	TCP
2024-12-28T21:10:23.833271+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50064	18.192.93.86	11048	TCP
2024-12-28T21:10:24.314601+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50064	18.192.93.86	11048	TCP
2024-12-28T21:10:24.434308+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50064	18.192.93.86	11048	TCP
2024-12-28T21:10:24.554394+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50064	18.192.93.86	11048	TCP
2024-12-28T21:10:24.674294+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50064	18.192.93.86	11048	TCP
2024-12-28T21:10:25.339329+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50064	18.192.93.86	11048	TCP
2024-12-28T21:10:25.459232+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50064	18.192.93.86	11048	TCP
2024-12-28T21:10:26.223684+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50065	18.192.93.86	11048	TCP
2024-12-28T21:10:26.223684+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50065	18.192.93.86	11048	TCP
2024-12-28T21:10:26.223684+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50065	18.192.93.86	11048	TCP
2024-12-28T21:10:26.223684+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50065	18.192.93.86	11048	TCP
2024-12-28T21:10:26.584655+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50065	18.192.93.86	11048	TCP
2024-12-28T21:10:27.422949+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50065	18.192.93.86	11048	TCP
2024-12-28T21:10:28.068402+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50065	18.192.93.86	11048	TCP
2024-12-28T21:10:28.462435+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50065	18.192.93.86	11048	TCP
2024-12-28T21:10:28.631109+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50066	18.192.93.86	11048	TCP
2024-12-28T21:10:28.631109+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50066	18.192.93.86	11048	TCP
2024-12-28T21:10:28.631109+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50066	18.192.93.86	11048	TCP
2024-12-28T21:10:28.631109+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50066	18.192.93.86	11048	TCP
2024-12-28T21:10:28.993546+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50066	18.192.93.86	11048	TCP
2024-12-28T21:10:29.357696+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50066	18.192.93.86	11048	TCP
2024-12-28T21:10:29.961956+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50066	18.192.93.86	11048	TCP
2024-12-28T21:10:30.201409+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50066	18.192.93.86	11048	TCP
2024-12-28T21:10:30.321097+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50066	18.192.93.86	11048	TCP
2024-12-28T21:10:30.440952+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50066	18.192.93.86	11048	TCP
2024-12-28T21:10:30.681864+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50066	18.192.93.86	11048	TCP
2024-12-28T21:10:31.041125+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50066	18.192.93.86	11048	TCP
2024-12-28T21:10:31.670987+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50067	18.192.93.86	11048	TCP
2024-12-28T21:10:31.670987+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50067	18.192.93.86	11048	TCP
2024-12-28T21:10:31.670987+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50067	18.192.93.86	11048	TCP
2024-12-28T21:10:31.670987+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50067	18.192.93.86	11048	TCP
2024-12-28T21:10:32.030660+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50067	18.192.93.86	11048	TCP
2024-12-28T21:10:32.150303+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50067	18.192.93.86	11048	TCP
2024-12-28T21:10:32.270026+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50067	18.192.93.86	11048	TCP
2024-12-28T21:10:33.140094+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50068	18.192.93.86	11048	TCP
2024-12-28T21:10:33.140094+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50068	18.192.93.86	11048	TCP
2024-12-28T21:10:33.140094+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50068	18.192.93.86	11048	TCP
2024-12-28T21:10:33.140094+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50068	18.192.93.86	11048	TCP
2024-12-28T21:10:33.859043+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50068	18.192.93.86	11048	TCP
2024-12-28T21:10:34.101657+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50068	18.192.93.86	11048	TCP
2024-12-28T21:10:34.571942+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50068	18.192.93.86	11048	TCP
2024-12-28T21:10:34.823236+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50069	18.192.93.86	11048	TCP
2024-12-28T21:10:34.823236+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50069	18.192.93.86	11048	TCP
2024-12-28T21:10:34.823236+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50069	18.192.93.86	11048	TCP
2024-12-28T21:10:34.823236+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50069	18.192.93.86	11048	TCP
2024-12-28T21:10:35.688276+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50069	18.192.93.86	11048	TCP
2024-12-28T21:10:36.047718+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50069	18.192.93.86	11048	TCP
2024-12-28T21:10:36.299021+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50070	18.192.93.86	11048	TCP
2024-12-28T21:10:36.299021+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50070	18.192.93.86	11048	TCP
2024-12-28T21:10:36.299021+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50070	18.192.93.86	11048	TCP
2024-12-28T21:10:36.299021+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50070	18.192.93.86	11048	TCP
2024-12-28T21:10:36.897472+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50070	18.192.93.86	11048	TCP
2024-12-28T21:10:37.377933+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50070	18.192.93.86	11048	TCP
2024-12-28T21:10:37.499513+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50070	18.192.93.86	11048	TCP
2024-12-28T21:10:37.728308+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50070	18.192.93.86	11048	TCP
2024-12-28T21:10:38.584287+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50071	18.192.93.86	11048	TCP
2024-12-28T21:10:38.584287+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50071	18.192.93.86	11048	TCP
2024-12-28T21:10:38.584287+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50071	18.192.93.86	11048	TCP
2024-12-28T21:10:38.584287+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50071	18.192.93.86	11048	TCP
2024-12-28T21:10:38.946871+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50071	18.192.93.86	11048	TCP
2024-12-28T21:10:39.186402+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50071	18.192.93.86	11048	TCP
2024-12-28T21:10:39.484267+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50072	18.192.93.86	11048	TCP
2024-12-28T21:10:39.484267+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50072	18.192.93.86	11048	TCP
2024-12-28T21:10:39.484267+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50072	18.192.93.86	11048	TCP
2024-12-28T21:10:39.484267+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50072	18.192.93.86	11048	TCP
2024-12-28T21:10:39.723671+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50072	18.192.93.86	11048	TCP
2024-12-28T21:10:40.133648+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50072	18.192.93.86	11048	TCP
2024-12-28T21:10:41.410969+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50073	18.192.93.86	11048	TCP
2024-12-28T21:10:41.410969+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50073	18.192.93.86	11048	TCP
2024-12-28T21:10:41.410969+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50073	18.192.93.86	11048	TCP
2024-12-28T21:10:41.410969+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50073	18.192.93.86	11048	TCP
2024-12-28T21:10:42.011326+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50073	18.192.93.86	11048	TCP
2024-12-28T21:10:42.131009+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50073	18.192.93.86	11048	TCP
2024-12-28T21:10:42.258183+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50073	18.192.93.86	11048	TCP
2024-12-28T21:10:42.743875+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50074	18.192.93.86	11048	TCP
2024-12-28T21:10:42.743875+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50074	18.192.93.86	11048	TCP
2024-12-28T21:10:42.743875+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50074	18.192.93.86	11048	TCP
2024-12-28T21:10:42.743875+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50074	18.192.93.86	11048	TCP
2024-12-28T21:10:43.707504+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50074	18.192.93.86	11048	TCP
2024-12-28T21:10:43.827276+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50074	18.192.93.86	11048	TCP
2024-12-28T21:10:44.087777+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50074	18.192.93.86	11048	TCP
2024-12-28T21:10:44.261786+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50075	18.192.93.86	11048	TCP
2024-12-28T21:10:44.261786+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50075	18.192.93.86	11048	TCP
2024-12-28T21:10:44.261786+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50075	18.192.93.86	11048	TCP
2024-12-28T21:10:44.261786+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50075	18.192.93.86	11048	TCP
2024-12-28T21:10:44.980968+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50075	18.192.93.86	11048	TCP
2024-12-28T21:10:45.101033+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50075	18.192.93.86	11048	TCP
2024-12-28T21:10:45.220873+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50075	18.192.93.86	11048	TCP
2024-12-28T21:10:45.713849+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50075	18.192.93.86	11048	TCP
2024-12-28T21:10:45.886881+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50076	18.192.93.86	11048	TCP
2024-12-28T21:10:45.886881+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50076	18.192.93.86	11048	TCP
2024-12-28T21:10:45.886881+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50076	18.192.93.86	11048	TCP
2024-12-28T21:10:45.886881+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50076	18.192.93.86	11048	TCP
2024-12-28T21:10:46.126719+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50076	18.192.93.86	11048	TCP
2024-12-28T21:10:46.486238+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50076	18.192.93.86	11048	TCP
2024-12-28T21:10:46.606222+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50076	18.192.93.86	11048	TCP
2024-12-28T21:10:46.726025+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50076	18.192.93.86	11048	TCP
2024-12-28T21:10:46.965466+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50076	18.192.93.86	11048	TCP
2024-12-28T21:10:47.085183+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50076	18.192.93.86	11048	TCP
2024-12-28T21:10:47.571861+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50077	18.192.93.86	11048	TCP
2024-12-28T21:10:47.571861+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50077	18.192.93.86	11048	TCP
2024-12-28T21:10:47.571861+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50077	18.192.93.86	11048	TCP
2024-12-28T21:10:47.571861+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50077	18.192.93.86	11048	TCP
2024-12-28T21:10:47.934477+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50077	18.192.93.86	11048	TCP
2024-12-28T21:10:48.054534+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50077	18.192.93.86	11048	TCP
2024-12-28T21:10:48.295388+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50077	18.192.93.86	11048	TCP
2024-12-28T21:10:48.415403+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50077	18.192.93.86	11048	TCP
2024-12-28T21:10:48.896245+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50077	18.192.93.86	11048	TCP
2024-12-28T21:10:48.946753+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50077	18.192.93.86	11048	TCP
2024-12-28T21:10:49.117583+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50078	18.192.93.86	11048	TCP
2024-12-28T21:10:49.117583+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50078	18.192.93.86	11048	TCP
2024-12-28T21:10:49.117583+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50078	18.192.93.86	11048	TCP
2024-12-28T21:10:49.117583+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50078	18.192.93.86	11048	TCP
2024-12-28T21:10:49.483251+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50078	18.192.93.86	11048	TCP
2024-12-28T21:10:49.602829+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50078	18.192.93.86	11048	TCP
2024-12-28T21:10:49.963316+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50078	18.192.93.86	11048	TCP
2024-12-28T21:10:50.082970+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50078	18.192.93.86	11048	TCP
2024-12-28T21:10:50.202774+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50078	18.192.93.86	11048	TCP
2024-12-28T21:10:50.442243+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50078	18.192.93.86	11048	TCP
2024-12-28T21:10:50.688877+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50079	18.192.93.86	11048	TCP
2024-12-28T21:10:50.688877+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50079	18.192.93.86	11048	TCP
2024-12-28T21:10:50.688877+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50079	18.192.93.86	11048	TCP
2024-12-28T21:10:50.688877+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50079	18.192.93.86	11048	TCP
2024-12-28T21:10:51.048828+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50079	18.192.93.86	11048	TCP
2024-12-28T21:10:51.409456+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50079	18.192.93.86	11048	TCP
2024-12-28T21:10:51.531554+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50079	18.192.93.86	11048	TCP
2024-12-28T21:10:52.012453+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50079	18.192.93.86	11048	TCP
2024-12-28T21:10:52.219293+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50080	18.192.93.86	11048	TCP
2024-12-28T21:10:52.219293+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50080	18.192.93.86	11048	TCP
2024-12-28T21:10:52.219293+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50080	18.192.93.86	11048	TCP
2024-12-28T21:10:52.219293+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50080	18.192.93.86	11048	TCP
2024-12-28T21:10:52.947499+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50080	18.192.93.86	11048	TCP
2024-12-28T21:10:53.067079+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50080	18.192.93.86	11048	TCP
2024-12-28T21:10:53.853639+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50081	18.192.93.86	11048	TCP
2024-12-28T21:10:53.853639+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50081	18.192.93.86	11048	TCP
2024-12-28T21:10:53.853639+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50081	18.192.93.86	11048	TCP
2024-12-28T21:10:53.853639+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50081	18.192.93.86	11048	TCP
2024-12-28T21:10:54.332182+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50081	18.192.93.86	11048	TCP
2024-12-28T21:10:54.451749+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50081	18.192.93.86	11048	TCP
2024-12-28T21:10:55.228017+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50081	18.192.93.86	11048	TCP
2024-12-28T21:10:55.420699+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50082	18.192.93.86	11048	TCP
2024-12-28T21:10:55.420699+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50082	18.192.93.86	11048	TCP
2024-12-28T21:10:55.420699+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50082	18.192.93.86	11048	TCP
2024-12-28T21:10:55.420699+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50082	18.192.93.86	11048	TCP
2024-12-28T21:10:55.781409+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50082	18.192.93.86	11048	TCP
2024-12-28T21:10:55.900986+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50082	18.192.93.86	11048	TCP
2024-12-28T21:10:56.642520+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50082	18.192.93.86	11048	TCP
2024-12-28T21:10:56.744002+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50082	18.192.93.86	11048	TCP
2024-12-28T21:10:56.916319+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50083	18.192.93.86	11048	TCP
2024-12-28T21:10:56.916319+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50083	18.192.93.86	11048	TCP
2024-12-28T21:10:56.916319+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50083	18.192.93.86	11048	TCP
2024-12-28T21:10:56.916319+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50083	18.192.93.86	11048	TCP
2024-12-28T21:10:59.130080+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50084	18.192.93.86	11048	TCP
2024-12-28T21:10:59.130080+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50084	18.192.93.86	11048	TCP
2024-12-28T21:10:59.130080+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50084	18.192.93.86	11048	TCP
2024-12-28T21:10:59.130080+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50084	18.192.93.86	11048	TCP
2024-12-28T21:10:59.369650+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50084	18.192.93.86	11048	TCP
2024-12-28T21:10:59.608928+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50084	18.192.93.86	11048	TCP
2024-12-28T21:11:00.627393+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50085	18.192.93.86	11048	TCP
2024-12-28T21:11:00.627393+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50085	18.192.93.86	11048	TCP
2024-12-28T21:11:00.627393+0100	2815696	ETPRO MALWARE Win32.FrauDrop.akljo Backdoor Beacon	1	192.168.2.4	50085	18.192.93.86	11048	TCP
2024-12-28T21:11:00.627393+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.4	50085	18.192.93.86	11048	TCP
2024-12-28T21:11:00.869659+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50085	18.192.93.86	11048	TCP
2024-12-28T21:11:00.989854+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50085	18.192.93.86	11048	TCP
2024-12-28T21:11:01.261652+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50085	18.192.93.86	11048	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 21:07:09.448801041 CET	49730	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:09.568500042 CET	11048	49730	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:09.568665981 CET	49730	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:09.834019899 CET	49730	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:09.953824997 CET	11048	49730	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:09.953895092 CET	49730	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:10.073491096 CET	11048	49730	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:11.777080059 CET	11048	49730	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:11.777249098 CET	49730	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:13.790165901 CET	49730	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:13.791251898 CET	49732	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:13.909810066 CET	11048	49730	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:13.910814047 CET	11048	49732	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:13.910891056 CET	49732	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:13.943805933 CET	49732	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:14.063359022 CET	11048	49732	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:14.063412905 CET	49732	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:14.183078051 CET	11048	49732	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:15.603959084 CET	49732	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:15.723893881 CET	11048	49732	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:16.115071058 CET	11048	49732	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:16.115149975 CET	49732	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:18.118187904 CET	49732	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:18.130436897 CET	49736	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:18.237912893 CET	11048	49732	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:18.249963999 CET	11048	49736	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:18.251076937 CET	49736	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:18.426110983 CET	49736	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:18.545604944 CET	11048	49736	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:18.545663118 CET	49736	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:18.665112019 CET	11048	49736	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:20.426156044 CET	11048	49736	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:20.426208019 CET	49736	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:21.039357901 CET	11048	49736	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:21.039414883 CET	49736	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:22.430619955 CET	49736	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:22.431802034 CET	49739	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:22.550789118 CET	11048	49736	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:22.551882029 CET	11048	49739	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:22.551963091 CET	49739	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:23.275794983 CET	49739	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:23.395476103 CET	11048	49739	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:23.395539045 CET	49739	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:23.515048027 CET	11048	49739	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:24.114969015 CET	49739	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:24.235044956 CET	11048	49739	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:24.763475895 CET	11048	49739	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:24.763681889 CET	49739	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:26.774451971 CET	49739	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:26.775296926 CET	49740	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:26.894309044 CET	11048	49739	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:26.894973993 CET	11048	49740	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:26.895062923 CET	49740	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:26.936208963 CET	49740	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:27.055891037 CET	11048	49740	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:27.055994034 CET	49740	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:27.175503016 CET	11048	49740	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:29.138699055 CET	11048	49740	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:29.138766050 CET	49740	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:31.149441957 CET	49740	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:31.150588036 CET	49741	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:31.270330906 CET	11048	49740	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:31.271100044 CET	11048	49741	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:31.271172047 CET	49741	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:31.869894981 CET	49741	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:31.989537954 CET	11048	49741	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:31.989706039 CET	49741	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:32.109559059 CET	11048	49741	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:32.429888010 CET	49741	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:32.549576044 CET	11048	49741	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:33.442478895 CET	11048	49741	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:33.443124056 CET	49741	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:35.446223974 CET	49741	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:35.447031975 CET	49742	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:35.565973997 CET	11048	49741	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:35.566569090 CET	11048	49742	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:35.566637993 CET	49742	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:35.721421957 CET	49742	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:35.841057062 CET	11048	49742	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:35.841116905 CET	49742	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:35.960982084 CET	11048	49742	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:38.044017076 CET	11048	49742	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:38.045099974 CET	49742	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:38.153892040 CET	11048	49742	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:38.157305956 CET	49742	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:40.059545040 CET	49742	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:40.060729980 CET	49743	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:40.179214954 CET	11048	49742	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:40.180355072 CET	11048	49743	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:40.180427074 CET	49743	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:41.161964893 CET	49743	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:41.281683922 CET	11048	49743	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:41.281758070 CET	49743	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:41.401405096 CET	11048	49743	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:42.374043941 CET	11048	49743	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:42.374116898 CET	49743	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:44.383752108 CET	49743	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:44.384560108 CET	49744	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:44.503253937 CET	11048	49743	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:44.504127026 CET	11048	49744	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:44.504199028 CET	49744	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:44.533731937 CET	49744	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:44.653372049 CET	11048	49744	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:44.653575897 CET	49744	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:44.773391962 CET	11048	49744	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:46.710583925 CET	11048	49744	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:46.710645914 CET	49744	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:48.712450981 CET	49744	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:48.713474035 CET	49745	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:48.832118988 CET	11048	49744	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:48.833009958 CET	11048	49745	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:48.833153009 CET	49745	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:50.148763895 CET	49745	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:50.268471956 CET	11048	49745	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:50.268537998 CET	49745	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:50.388243914 CET	11048	49745	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:51.076657057 CET	11048	49745	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:51.079181910 CET	49745	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:53.087120056 CET	49745	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:53.088929892 CET	49746	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:53.206878901 CET	11048	49745	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:53.208561897 CET	11048	49746	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:53.209032059 CET	49746	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:53.239659071 CET	49746	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:53.359548092 CET	11048	49746	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:53.359613895 CET	49746	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:53.479454041 CET	11048	49746	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:53.806094885 CET	49746	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:53.926090002 CET	11048	49746	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:55.421216965 CET	11048	49746	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:55.421283007 CET	49746	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:57.439986944 CET	49746	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:57.559607029 CET	11048	49746	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:57.629131079 CET	49749	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:57.748766899 CET	11048	49749	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:57.748850107 CET	49749	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:57.847206116 CET	49749	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:57.966959000 CET	11048	49749	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:57.967015028 CET	49749	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:58.086496115 CET	11048	49749	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:58.087104082 CET	49749	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:07:58.206593037 CET	11048	49749	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:59.959028959 CET	11048	49749	3.126.37.18	192.168.2.4
Dec 28, 2024 21:07:59.959156036 CET	49749	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:08:01.961982965 CET	49749	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:08:01.963072062 CET	49760	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:08:02.081584930 CET	11048	49749	3.126.37.18	192.168.2.4
Dec 28, 2024 21:08:02.082537889 CET	11048	49760	3.126.37.18	192.168.2.4
Dec 28, 2024 21:08:02.082680941 CET	49760	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:08:02.113255978 CET	49760	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:08:02.232942104 CET	11048	49760	3.126.37.18	192.168.2.4
Dec 28, 2024 21:08:02.233313084 CET	49760	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:08:02.353451967 CET	11048	49760	3.126.37.18	192.168.2.4
Dec 28, 2024 21:08:03.634253025 CET	49760	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:08:03.753741980 CET	11048	49760	3.126.37.18	192.168.2.4
Dec 28, 2024 21:08:04.255831957 CET	11048	49760	3.126.37.18	192.168.2.4
Dec 28, 2024 21:08:04.257724047 CET	49760	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:08:06.274466038 CET	49760	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:08:06.275512934 CET	49771	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:08:06.393989086 CET	11048	49760	3.126.37.18	192.168.2.4
Dec 28, 2024 21:08:06.395096064 CET	11048	49771	3.126.37.18	192.168.2.4
Dec 28, 2024 21:08:06.395220041 CET	49771	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:08:06.584970951 CET	49771	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:08:06.704654932 CET	11048	49771	3.126.37.18	192.168.2.4
Dec 28, 2024 21:08:06.704874992 CET	49771	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:08:06.824532032 CET	11048	49771	3.126.37.18	192.168.2.4
Dec 28, 2024 21:08:07.103079081 CET	49771	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:08:07.222883940 CET	11048	49771	3.126.37.18	192.168.2.4
Dec 28, 2024 21:08:08.212650061 CET	49771	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:08:08.332282066 CET	11048	49771	3.126.37.18	192.168.2.4
Dec 28, 2024 21:08:08.611241102 CET	11048	49771	3.126.37.18	192.168.2.4
Dec 28, 2024 21:08:08.613395929 CET	49771	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:08:10.618269920 CET	49771	11048	192.168.2.4	3.126.37.18
Dec 28, 2024 21:08:10.737864017 CET	11048	49771	3.126.37.18	192.168.2.4
Dec 28, 2024 21:08:10.834414959 CET	49782	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:10.953933954 CET	11048	49782	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:10.954056978 CET	49782	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:11.018168926 CET	49782	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:11.137706995 CET	11048	49782	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:11.137753963 CET	49782	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:11.257438898 CET	11048	49782	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:11.681647062 CET	49782	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:11.801738977 CET	11048	49782	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:11.884167910 CET	49782	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:12.003695011 CET	11048	49782	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:12.932806015 CET	49782	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:13.052375078 CET	11048	49782	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:13.055838108 CET	49782	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:13.161492109 CET	11048	49782	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:13.161653996 CET	49782	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:13.175374985 CET	11048	49782	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:13.281286955 CET	11048	49782	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:15.166707993 CET	49791	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:15.286293983 CET	11048	49791	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:15.288187027 CET	49791	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:15.359824896 CET	49791	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:15.479319096 CET	11048	49791	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:15.480679035 CET	49791	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:15.600224972 CET	11048	49791	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:15.600331068 CET	49791	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:15.722374916 CET	11048	49791	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:15.722543955 CET	49791	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:15.842050076 CET	11048	49791	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:15.843409061 CET	49791	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:15.963012934 CET	11048	49791	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:15.965311050 CET	49791	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:16.084775925 CET	11048	49791	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:16.085614920 CET	49791	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:16.206101894 CET	11048	49791	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:16.207498074 CET	49791	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:16.327523947 CET	11048	49791	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:16.329400063 CET	49791	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:16.448864937 CET	11048	49791	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:16.448944092 CET	49791	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:16.568506956 CET	11048	49791	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:16.568653107 CET	49791	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:16.688868046 CET	11048	49791	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:16.688954115 CET	49791	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:16.808423996 CET	11048	49791	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:16.808542013 CET	49791	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:16.928515911 CET	11048	49791	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:16.928577900 CET	49791	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:17.048013926 CET	11048	49791	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:17.048084974 CET	49791	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:17.167521000 CET	11048	49791	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:17.491147041 CET	11048	49791	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:17.491259098 CET	49791	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:19.493366003 CET	49791	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:19.502966881 CET	49801	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:19.613481045 CET	11048	49791	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:19.622469902 CET	11048	49801	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:19.625349998 CET	49801	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:19.772249937 CET	49801	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:19.891732931 CET	11048	49801	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:19.891807079 CET	49801	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:20.011692047 CET	11048	49801	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:20.013222933 CET	49801	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:20.132742882 CET	11048	49801	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:20.707340956 CET	49801	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:20.826806068 CET	11048	49801	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:20.826857090 CET	49801	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:20.946371078 CET	11048	49801	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:20.946430922 CET	49801	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:21.065923929 CET	11048	49801	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:21.065979004 CET	49801	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:21.185540915 CET	11048	49801	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:21.185719967 CET	49801	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:21.305674076 CET	11048	49801	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:21.305747986 CET	49801	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:21.425261021 CET	11048	49801	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:21.425314903 CET	49801	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:21.545476913 CET	11048	49801	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:21.545535088 CET	49801	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:21.665318966 CET	11048	49801	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:21.665378094 CET	49801	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:21.784936905 CET	11048	49801	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:21.786367893 CET	49801	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:21.876883984 CET	11048	49801	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:21.879218102 CET	49801	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:21.905877113 CET	11048	49801	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:21.998759031 CET	11048	49801	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:23.760266066 CET	49812	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:23.880013943 CET	11048	49812	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:23.880192041 CET	49812	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:23.910907030 CET	49812	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:24.030441999 CET	11048	49812	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:24.030582905 CET	49812	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:24.150114059 CET	11048	49812	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:24.150294065 CET	49812	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:24.269737959 CET	11048	49812	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:24.269823074 CET	49812	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:24.389413118 CET	11048	49812	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:24.389769077 CET	49812	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:24.509572983 CET	11048	49812	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:24.509896994 CET	49812	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:24.629345894 CET	11048	49812	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:24.629429102 CET	49812	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:24.748980045 CET	11048	49812	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:24.751245022 CET	49812	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:24.871083021 CET	11048	49812	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:24.871272087 CET	49812	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:24.991118908 CET	11048	49812	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:24.991221905 CET	49812	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:25.111516953 CET	11048	49812	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:25.111577034 CET	49812	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:25.231678009 CET	11048	49812	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:25.235389948 CET	49812	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:25.354902029 CET	11048	49812	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:25.355251074 CET	49812	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:25.474742889 CET	11048	49812	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:25.475277901 CET	49812	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:25.594856024 CET	11048	49812	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:25.594933033 CET	49812	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:25.714438915 CET	11048	49812	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:25.715241909 CET	49812	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:25.834747076 CET	11048	49812	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:25.834856987 CET	49812	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:25.954368114 CET	11048	49812	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:25.955715895 CET	49812	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:26.076116085 CET	11048	49812	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:26.079231977 CET	49812	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:26.141421080 CET	11048	49812	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:26.143248081 CET	49812	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:26.199095964 CET	11048	49812	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:26.262716055 CET	11048	49812	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:27.900665045 CET	49822	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:28.020243883 CET	11048	49822	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:28.020617962 CET	49822	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:28.058099031 CET	49822	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:28.177654982 CET	11048	49822	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:28.182027102 CET	49822	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:28.301651001 CET	11048	49822	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:28.305754900 CET	49822	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:28.425318003 CET	11048	49822	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:28.427078962 CET	49822	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:28.546566963 CET	11048	49822	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:28.546619892 CET	49822	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:28.666137934 CET	11048	49822	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:28.666198969 CET	49822	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:28.785834074 CET	11048	49822	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:28.785995007 CET	49822	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:28.905447006 CET	11048	49822	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:28.905508995 CET	49822	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:29.025049925 CET	11048	49822	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:29.025113106 CET	49822	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:29.144552946 CET	11048	49822	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:29.144613981 CET	49822	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:29.264130116 CET	11048	49822	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:29.264229059 CET	49822	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:29.383701086 CET	11048	49822	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:29.383847952 CET	49822	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:29.503268957 CET	11048	49822	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:29.504616022 CET	49822	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:29.624344110 CET	11048	49822	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:29.624449968 CET	49822	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:29.743992090 CET	11048	49822	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:29.770800114 CET	49822	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:29.890343904 CET	11048	49822	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:29.891210079 CET	49822	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:30.010730982 CET	11048	49822	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:30.220201969 CET	11048	49822	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:30.223232985 CET	49822	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:31.868299961 CET	49822	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:31.869333982 CET	49830	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:31.987725973 CET	11048	49822	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:31.988873959 CET	11048	49830	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:31.989099026 CET	49830	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:32.045706987 CET	49830	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:32.165173054 CET	11048	49830	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:32.165396929 CET	49830	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:32.284826040 CET	11048	49830	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:32.287230015 CET	49830	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:32.406807899 CET	11048	49830	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:33.337024927 CET	11048	49830	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:33.337127924 CET	49830	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:34.868319988 CET	49830	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:34.869360924 CET	49838	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:34.987862110 CET	11048	49830	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:34.988890886 CET	11048	49838	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:34.989037037 CET	49838	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:35.028522015 CET	49838	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:35.148076057 CET	11048	49838	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:35.148133039 CET	49838	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:35.268011093 CET	11048	49838	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:35.269242048 CET	49838	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:35.388700962 CET	11048	49838	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:35.389364958 CET	49838	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:35.509176016 CET	11048	49838	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:35.509277105 CET	49838	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:35.628799915 CET	11048	49838	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:36.175637960 CET	49838	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:36.295061111 CET	11048	49838	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:36.295110941 CET	49838	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:36.389101982 CET	11048	49838	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:36.389174938 CET	49838	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:36.414643049 CET	11048	49838	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:36.508656979 CET	11048	49838	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:37.810362101 CET	49845	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:37.929982901 CET	11048	49845	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:37.930124044 CET	49845	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:37.998859882 CET	49845	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:38.118338108 CET	11048	49845	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:38.118410110 CET	49845	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:38.238033056 CET	11048	49845	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:38.238112926 CET	49845	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:38.357628107 CET	11048	49845	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:38.357692003 CET	49845	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:38.477191925 CET	11048	49845	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:38.477257013 CET	49845	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:38.596710920 CET	11048	49845	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:38.596798897 CET	49845	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:38.718384027 CET	11048	49845	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:38.718439102 CET	49845	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:38.837901115 CET	11048	49845	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:38.837966919 CET	49845	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:38.957539082 CET	11048	49845	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:38.957597971 CET	49845	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:39.077182055 CET	11048	49845	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:39.077265024 CET	49845	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:39.196799040 CET	11048	49845	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:39.196887970 CET	49845	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:39.316843033 CET	11048	49845	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:39.316946983 CET	49845	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:39.333229065 CET	11048	49845	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:39.333292007 CET	49845	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:39.436450005 CET	11048	49845	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:39.452780008 CET	11048	49845	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:40.666919947 CET	49852	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:40.786418915 CET	11048	49852	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:40.786489964 CET	49852	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:40.839555979 CET	49852	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:40.959125042 CET	11048	49852	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:40.959229946 CET	49852	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:41.154346943 CET	11048	49852	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:41.154433966 CET	49852	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:41.275928020 CET	11048	49852	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:41.276016951 CET	49852	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:41.395981073 CET	11048	49852	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:41.396235943 CET	49852	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:41.517177105 CET	11048	49852	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:41.517227888 CET	49852	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:41.636704922 CET	11048	49852	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:41.636780024 CET	49852	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:41.756505966 CET	11048	49852	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:41.756560087 CET	49852	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:41.876148939 CET	11048	49852	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:41.876200914 CET	49852	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:41.995770931 CET	11048	49852	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:41.995872974 CET	49852	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:42.117794991 CET	11048	49852	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:42.117911100 CET	49852	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:42.182727098 CET	11048	49852	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:42.182826996 CET	49852	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:42.237525940 CET	11048	49852	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:42.302362919 CET	11048	49852	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:43.432090998 CET	49860	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:43.551651955 CET	11048	49860	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:43.555372953 CET	49860	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:43.598925114 CET	49860	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:43.718578100 CET	11048	49860	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:43.718626022 CET	49860	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:43.838206053 CET	11048	49860	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:43.838268042 CET	49860	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:43.957823992 CET	11048	49860	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:43.957885027 CET	49860	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:44.077434063 CET	11048	49860	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:44.083275080 CET	49860	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:44.202785969 CET	11048	49860	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:44.202928066 CET	49860	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:44.322663069 CET	11048	49860	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:44.325680971 CET	49860	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:44.445602894 CET	11048	49860	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:44.446527004 CET	49860	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:44.566482067 CET	11048	49860	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:44.567257881 CET	49860	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:44.687861919 CET	11048	49860	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:44.689281940 CET	49860	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:44.808743000 CET	11048	49860	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:44.810381889 CET	49860	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:44.929845095 CET	11048	49860	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:44.929919004 CET	49860	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:45.000647068 CET	11048	49860	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:45.000696898 CET	49860	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:45.049489975 CET	11048	49860	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:45.120156050 CET	11048	49860	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:46.169625044 CET	49866	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:46.289139986 CET	11048	49866	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:46.289211988 CET	49866	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:46.406182051 CET	49866	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:46.525818110 CET	11048	49866	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:46.525876999 CET	49866	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:46.646327972 CET	11048	49866	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:46.646519899 CET	49866	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:46.766213894 CET	11048	49866	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:46.766266108 CET	49866	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:46.885782003 CET	11048	49866	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:46.885869026 CET	49866	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:47.005460978 CET	11048	49866	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:47.005551100 CET	49866	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:47.125011921 CET	11048	49866	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:47.125086069 CET	49866	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:47.244550943 CET	11048	49866	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:47.244642973 CET	49866	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:47.364145994 CET	11048	49866	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:47.380744934 CET	49866	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:47.500186920 CET	11048	49866	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:47.500241995 CET	49866	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:47.619935036 CET	11048	49866	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:47.620176077 CET	49866	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:47.681844950 CET	11048	49866	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:47.682179928 CET	49866	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:47.739788055 CET	11048	49866	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:47.801661015 CET	11048	49866	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:48.760032892 CET	49872	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:48.879515886 CET	11048	49872	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:48.879751921 CET	49872	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:48.918293953 CET	49872	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:49.037828922 CET	11048	49872	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:49.037939072 CET	49872	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:49.157486916 CET	11048	49872	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:49.157567978 CET	49872	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:49.277127028 CET	11048	49872	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:49.277184963 CET	49872	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:49.399852037 CET	11048	49872	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:49.400034904 CET	49872	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:49.521200895 CET	11048	49872	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:49.521250010 CET	49872	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:49.640860081 CET	11048	49872	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:49.640949011 CET	49872	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:49.760426044 CET	11048	49872	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:49.760485888 CET	49872	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:49.879981995 CET	11048	49872	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:49.880028963 CET	49872	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:49.999495983 CET	11048	49872	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:49.999567986 CET	49872	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:50.119091034 CET	11048	49872	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:50.119340897 CET	49872	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:50.238965034 CET	11048	49872	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:50.239259005 CET	49872	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:50.286622047 CET	11048	49872	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:50.286820889 CET	49872	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:50.358828068 CET	11048	49872	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:50.406260014 CET	11048	49872	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:51.291634083 CET	49878	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:51.411309958 CET	11048	49878	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:51.411406040 CET	49878	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:51.549705982 CET	49878	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:51.669224977 CET	11048	49878	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:51.669327021 CET	49878	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:51.788968086 CET	11048	49878	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:51.789037943 CET	49878	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:51.908665895 CET	11048	49878	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:51.908720970 CET	49878	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:52.028259039 CET	11048	49878	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:52.028523922 CET	49878	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:52.148277044 CET	11048	49878	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:52.148513079 CET	49878	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:52.268148899 CET	11048	49878	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:52.268326998 CET	49878	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:52.388076067 CET	11048	49878	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:52.388283968 CET	49878	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:52.507917881 CET	11048	49878	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:52.509325027 CET	49878	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:52.628781080 CET	11048	49878	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:52.628850937 CET	49878	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:52.748343945 CET	11048	49878	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:52.748435020 CET	49878	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:52.774827003 CET	11048	49878	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:52.774897099 CET	49878	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:52.868000984 CET	11048	49878	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:52.894349098 CET	11048	49878	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:53.742645025 CET	49884	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:53.862109900 CET	11048	49884	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:53.862210989 CET	49884	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:54.250997066 CET	49884	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:54.370459080 CET	11048	49884	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:54.370534897 CET	49884	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:54.490406990 CET	11048	49884	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:54.563180923 CET	49884	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:54.682646990 CET	11048	49884	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:54.682744980 CET	49884	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:54.802310944 CET	11048	49884	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:54.802357912 CET	49884	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:54.921919107 CET	11048	49884	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:54.921974897 CET	49884	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:55.041452885 CET	11048	49884	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:55.041533947 CET	49884	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:55.161010981 CET	11048	49884	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:55.161061049 CET	49884	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:55.262268066 CET	11048	49884	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:55.262458086 CET	49884	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:55.280586004 CET	11048	49884	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:55.381995916 CET	11048	49884	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:56.154139042 CET	49890	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:56.276271105 CET	11048	49890	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:56.276426077 CET	49890	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:56.322390079 CET	49890	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:56.441880941 CET	11048	49890	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:56.442357063 CET	49890	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:56.561990023 CET	11048	49890	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:56.562042952 CET	49890	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:56.681992054 CET	11048	49890	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:56.682195902 CET	49890	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:56.801831961 CET	11048	49890	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:56.801903009 CET	49890	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:56.921556950 CET	11048	49890	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:56.921621084 CET	49890	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:57.041397095 CET	11048	49890	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:57.300084114 CET	49890	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:57.419699907 CET	11048	49890	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:57.663655996 CET	11048	49890	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:57.667448997 CET	49890	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:58.493740082 CET	49890	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:58.494888067 CET	49896	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:58.613218069 CET	11048	49890	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:58.614371061 CET	11048	49896	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:58.614469051 CET	49896	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:58.707818031 CET	49896	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:58.828128099 CET	11048	49896	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:58.828306913 CET	49896	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:58.947755098 CET	11048	49896	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:58.947824955 CET	49896	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:59.067382097 CET	11048	49896	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:59.067544937 CET	49896	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:59.187412977 CET	11048	49896	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:59.187453032 CET	49896	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:59.306968927 CET	11048	49896	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:59.307044983 CET	49896	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:59.428622961 CET	11048	49896	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:59.428932905 CET	49896	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:59.548511982 CET	11048	49896	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:59.551399946 CET	49896	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:59.670931101 CET	11048	49896	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:59.671278000 CET	49896	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:59.790729046 CET	11048	49896	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:59.792463064 CET	49896	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:08:59.912103891 CET	11048	49896	18.156.13.209	192.168.2.4
Dec 28, 2024 21:08:59.915307045 CET	49896	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:00.035212040 CET	11048	49896	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:00.035422087 CET	49896	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:00.059973001 CET	11048	49896	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:00.063474894 CET	49896	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:00.154860973 CET	11048	49896	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:00.183020115 CET	11048	49896	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:00.838542938 CET	49904	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:00.958148956 CET	11048	49904	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:00.958240986 CET	49904	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:01.031542063 CET	49904	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:01.151091099 CET	11048	49904	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:01.151262045 CET	49904	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:01.270838976 CET	11048	49904	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:01.270936012 CET	49904	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:01.390453100 CET	11048	49904	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:01.390691042 CET	49904	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:01.511606932 CET	11048	49904	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:01.511804104 CET	49904	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:01.631664038 CET	11048	49904	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:01.631757021 CET	49904	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:01.751338005 CET	11048	49904	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:01.751554966 CET	49904	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:01.872529030 CET	11048	49904	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:01.872596025 CET	49904	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:01.993206024 CET	11048	49904	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:01.993309021 CET	49904	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:02.113547087 CET	11048	49904	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:02.113619089 CET	49904	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:02.236854076 CET	11048	49904	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:02.236921072 CET	49904	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:02.357798100 CET	11048	49904	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:02.357861042 CET	49904	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:02.386812925 CET	11048	49904	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:02.386893988 CET	49904	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:02.477272034 CET	11048	49904	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:02.506401062 CET	11048	49904	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:03.104171038 CET	49910	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:03.223642111 CET	11048	49910	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:03.223715067 CET	49910	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:03.299989939 CET	49910	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:03.419729948 CET	11048	49910	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:03.419797897 CET	49910	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:03.539653063 CET	11048	49910	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:03.541054964 CET	49910	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:03.660621881 CET	11048	49910	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:03.662338972 CET	49910	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:03.782036066 CET	11048	49910	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:03.782279015 CET	49910	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:03.901830912 CET	11048	49910	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:03.902168989 CET	49910	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:04.022211075 CET	11048	49910	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:04.027306080 CET	49910	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:04.148031950 CET	11048	49910	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:04.148140907 CET	49910	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:04.267642975 CET	11048	49910	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:04.270454884 CET	49910	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:04.390081882 CET	11048	49910	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:04.390144110 CET	49910	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:04.509753942 CET	11048	49910	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:04.515332937 CET	49910	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:04.592202902 CET	11048	49910	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:04.593316078 CET	49910	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:04.634860039 CET	11048	49910	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:04.712923050 CET	11048	49910	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:05.260190964 CET	49914	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:05.379826069 CET	11048	49914	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:05.380108118 CET	49914	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:05.507174015 CET	49914	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:05.627671957 CET	11048	49914	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:05.627763033 CET	49914	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:05.748305082 CET	11048	49914	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:05.748382092 CET	49914	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:05.869687080 CET	11048	49914	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:05.869755983 CET	49914	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:05.989450932 CET	11048	49914	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:05.989532948 CET	49914	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:06.109214067 CET	11048	49914	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:06.109272957 CET	49914	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:06.228827000 CET	11048	49914	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:06.228876114 CET	49914	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:06.348350048 CET	11048	49914	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:06.355665922 CET	49914	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:06.475298882 CET	11048	49914	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:06.475379944 CET	49914	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:06.595071077 CET	11048	49914	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:06.595849991 CET	49914	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:06.715487957 CET	11048	49914	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:06.715548992 CET	49914	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:06.774292946 CET	11048	49914	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:06.774348021 CET	49914	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:06.890811920 CET	11048	49914	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:06.893876076 CET	11048	49914	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:07.400661945 CET	49920	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:07.521038055 CET	11048	49920	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:07.521136999 CET	49920	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:07.571962118 CET	49920	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:07.691528082 CET	11048	49920	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:07.691627026 CET	49920	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:07.812119961 CET	11048	49920	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:07.812175989 CET	49920	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:07.931643009 CET	11048	49920	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:07.936078072 CET	49920	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:08.055522919 CET	11048	49920	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:08.055579901 CET	49920	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:08.176003933 CET	11048	49920	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:08.176060915 CET	49920	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:08.296521902 CET	11048	49920	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:08.296591997 CET	49920	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:08.416759014 CET	11048	49920	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:08.416824102 CET	49920	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:08.538929939 CET	11048	49920	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:08.541338921 CET	49920	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:08.662391901 CET	11048	49920	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:08.662487030 CET	49920	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:08.784235954 CET	11048	49920	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:08.787360907 CET	49920	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:08.906826019 CET	11048	49920	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:08.911323071 CET	49920	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:08.918402910 CET	11048	49920	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:08.923336029 CET	49920	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:09.030898094 CET	11048	49920	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:09.042810917 CET	11048	49920	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:09.510186911 CET	49926	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:09.629813910 CET	11048	49926	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:09.629944086 CET	49926	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:09.673016071 CET	49926	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:09.792694092 CET	11048	49926	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:09.792748928 CET	49926	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:09.912206888 CET	11048	49926	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:09.912280083 CET	49926	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:10.031919003 CET	11048	49926	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:10.032001019 CET	49926	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:10.152565956 CET	11048	49926	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:10.152657032 CET	49926	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:10.272239923 CET	11048	49926	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:10.272291899 CET	49926	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:10.392049074 CET	11048	49926	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:10.392131090 CET	49926	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:10.511692047 CET	11048	49926	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:10.511739016 CET	49926	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:10.631319046 CET	11048	49926	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:10.633368969 CET	49926	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:10.752913952 CET	11048	49926	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:10.753401041 CET	49926	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:10.873105049 CET	11048	49926	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:10.874346972 CET	49926	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:10.984011889 CET	11048	49926	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:10.986370087 CET	49926	11048	192.168.2.4	18.156.13.209
Dec 28, 2024 21:09:10.993892908 CET	11048	49926	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:11.105905056 CET	11048	49926	18.156.13.209	192.168.2.4
Dec 28, 2024 21:09:11.755445004 CET	49932	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:11.876147985 CET	11048	49932	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:11.876218081 CET	49932	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:11.927093983 CET	49932	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:12.046648979 CET	11048	49932	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:12.046726942 CET	49932	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:12.166203976 CET	11048	49932	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:12.166306973 CET	49932	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:12.285799026 CET	11048	49932	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:12.285845995 CET	49932	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:12.405349970 CET	11048	49932	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:12.411413908 CET	49932	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:12.530996084 CET	11048	49932	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:12.531063080 CET	49932	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:12.650620937 CET	11048	49932	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:12.655339956 CET	49932	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:12.774909973 CET	11048	49932	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:12.775276899 CET	49932	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:12.895389080 CET	11048	49932	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:12.898339987 CET	49932	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:13.017930031 CET	11048	49932	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:13.018006086 CET	49932	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:13.137700081 CET	11048	49932	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:13.139410973 CET	49932	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:13.258932114 CET	11048	49932	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:13.259027004 CET	49932	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:13.281876087 CET	11048	49932	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:13.283325911 CET	49932	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:13.378808975 CET	11048	49932	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:13.402872086 CET	11048	49932	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:13.791696072 CET	49938	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:13.911216021 CET	11048	49938	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:13.911336899 CET	49938	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:14.069396973 CET	49938	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:14.188939095 CET	11048	49938	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:14.189008951 CET	49938	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:14.308789968 CET	11048	49938	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:14.308835983 CET	49938	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:14.428632975 CET	11048	49938	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:14.428683996 CET	49938	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:14.548194885 CET	11048	49938	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:14.548257113 CET	49938	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:14.669537067 CET	11048	49938	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:14.675331116 CET	49938	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:14.794821024 CET	11048	49938	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:14.794883013 CET	49938	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:14.914546967 CET	11048	49938	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:14.917344093 CET	49938	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:15.036849976 CET	11048	49938	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:15.037364960 CET	49938	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:15.156851053 CET	11048	49938	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:15.157339096 CET	49938	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:15.272589922 CET	11048	49938	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:15.272649050 CET	49938	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:15.280778885 CET	11048	49938	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:15.392198086 CET	11048	49938	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:15.745891094 CET	49944	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:15.865458965 CET	11048	49944	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:15.871407032 CET	49944	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:16.358428955 CET	49944	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:16.478096962 CET	11048	49944	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:16.478153944 CET	49944	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:16.597750902 CET	11048	49944	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:16.597798109 CET	49944	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:16.717308998 CET	11048	49944	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:16.717382908 CET	49944	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:16.836833000 CET	11048	49944	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:16.836877108 CET	49944	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:16.956413031 CET	11048	49944	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:16.956465960 CET	49944	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:17.075948954 CET	11048	49944	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:17.076019049 CET	49944	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:17.195538998 CET	11048	49944	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:17.195749998 CET	49944	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:17.309490919 CET	11048	49944	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:17.309592962 CET	49944	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:17.315210104 CET	11048	49944	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:17.429259062 CET	11048	49944	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:17.760935068 CET	49950	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:17.880485058 CET	11048	49950	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:17.883462906 CET	49950	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:17.971530914 CET	49950	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:18.091034889 CET	11048	49950	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:18.091840029 CET	49950	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:18.211380959 CET	11048	49950	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:18.211447001 CET	49950	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:18.331105947 CET	11048	49950	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:18.331182003 CET	49950	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:18.450701952 CET	11048	49950	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:19.105678082 CET	49950	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:19.225116014 CET	11048	49950	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:19.227344990 CET	49950	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:19.280337095 CET	11048	49950	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:19.280503035 CET	49950	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:19.346961975 CET	11048	49950	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:19.399991035 CET	11048	49950	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:19.700033903 CET	49956	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:19.819777966 CET	11048	49956	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:19.819894075 CET	49956	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:19.853666067 CET	49956	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:19.973412037 CET	11048	49956	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:19.973613024 CET	49956	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:20.093311071 CET	11048	49956	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:20.093374014 CET	49956	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:20.212876081 CET	11048	49956	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:20.267033100 CET	49956	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:20.386832952 CET	11048	49956	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:20.386883020 CET	49956	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:20.507216930 CET	11048	49956	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:20.507412910 CET	49956	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:20.626900911 CET	11048	49956	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:20.627456903 CET	49956	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:20.747008085 CET	11048	49956	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:20.747347116 CET	49956	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:20.866842031 CET	11048	49956	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:20.867346048 CET	49956	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:20.986954927 CET	11048	49956	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:20.989366055 CET	49956	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:21.108831882 CET	11048	49956	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:21.109554052 CET	49956	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:21.229039907 CET	11048	49956	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:21.229473114 CET	49956	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:21.230768919 CET	11048	49956	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:21.230839014 CET	49956	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:21.348911047 CET	11048	49956	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:21.350258112 CET	11048	49956	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:21.619410038 CET	49962	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:21.738945007 CET	11048	49962	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:21.739027023 CET	49962	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:21.814418077 CET	49962	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:21.935286045 CET	11048	49962	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:21.935574055 CET	49962	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:22.055152893 CET	11048	49962	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:22.055226088 CET	49962	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:22.175163031 CET	11048	49962	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:22.175220966 CET	49962	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:22.294984102 CET	11048	49962	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:22.295038939 CET	49962	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:22.414582014 CET	11048	49962	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:22.414633036 CET	49962	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:22.534245968 CET	11048	49962	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:22.534296989 CET	49962	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:22.654047966 CET	11048	49962	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:22.654151917 CET	49962	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:22.773747921 CET	11048	49962	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:22.774818897 CET	49962	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:22.894269943 CET	11048	49962	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:22.897972107 CET	49962	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:23.017499924 CET	11048	49962	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:23.017539024 CET	49962	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:23.137151957 CET	11048	49962	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:23.137376070 CET	49962	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:23.142369032 CET	11048	49962	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:23.142436981 CET	49962	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:23.257066011 CET	11048	49962	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:23.262015104 CET	11048	49962	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:23.510143995 CET	49964	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:23.629640102 CET	11048	49964	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:23.631371021 CET	49964	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:23.693331957 CET	49964	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:23.812916994 CET	11048	49964	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:23.814356089 CET	49964	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:23.933888912 CET	11048	49964	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:23.936001062 CET	49964	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:24.055449963 CET	11048	49964	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:24.055506945 CET	49964	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:24.175081968 CET	11048	49964	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:24.175142050 CET	49964	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:24.294955969 CET	11048	49964	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:24.297466040 CET	49964	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:24.417021990 CET	11048	49964	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:24.417124033 CET	49964	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:24.536746025 CET	11048	49964	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:24.536838055 CET	49964	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:24.656348944 CET	11048	49964	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:24.656538010 CET	49964	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:24.776012897 CET	11048	49964	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:24.776082993 CET	49964	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:24.895520926 CET	11048	49964	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:24.895590067 CET	49964	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:25.015060902 CET	11048	49964	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:25.015142918 CET	49964	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:25.058105946 CET	11048	49964	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:25.058186054 CET	49964	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:25.134677887 CET	11048	49964	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:25.177731037 CET	11048	49964	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:25.401276112 CET	49969	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:25.642117977 CET	11048	49969	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:25.642205000 CET	49969	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:25.681224108 CET	49969	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:25.800789118 CET	11048	49969	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:25.800875902 CET	49969	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:25.920339108 CET	11048	49969	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:25.920443058 CET	49969	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:26.040049076 CET	11048	49969	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:26.040103912 CET	49969	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:26.159689903 CET	11048	49969	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:26.159735918 CET	49969	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:26.279258966 CET	11048	49969	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:26.279329062 CET	49969	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:26.399080992 CET	11048	49969	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:26.399128914 CET	49969	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:26.518755913 CET	11048	49969	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:26.667737961 CET	49969	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:26.787328959 CET	11048	49969	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:26.789395094 CET	49969	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:26.908865929 CET	11048	49969	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:26.909081936 CET	49969	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:27.004951000 CET	11048	49969	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:27.005109072 CET	49969	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:27.028542042 CET	11048	49969	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:27.124612093 CET	11048	49969	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:27.328013897 CET	49975	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:27.447560072 CET	11048	49975	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:27.451391935 CET	49975	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:27.503838062 CET	49975	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:27.623368979 CET	11048	49975	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:27.623424053 CET	49975	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:27.742923975 CET	11048	49975	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:27.742997885 CET	49975	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:27.862437010 CET	11048	49975	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:27.862493992 CET	49975	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:27.981990099 CET	11048	49975	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:27.982117891 CET	49975	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:28.101926088 CET	11048	49975	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:28.102006912 CET	49975	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:28.221573114 CET	11048	49975	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:28.221632957 CET	49975	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:28.341206074 CET	11048	49975	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:28.341258049 CET	49975	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:28.460705996 CET	11048	49975	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:28.460752964 CET	49975	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:28.581118107 CET	11048	49975	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:28.581185102 CET	49975	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:28.700695038 CET	11048	49975	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:28.701742887 CET	49975	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:28.810230017 CET	11048	49975	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:28.813591003 CET	49975	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:28.821760893 CET	11048	49975	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:28.934812069 CET	11048	49975	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:29.119512081 CET	49981	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:29.239264965 CET	11048	49981	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:29.241713047 CET	49981	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:29.283726931 CET	49981	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:29.405929089 CET	11048	49981	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:29.406006098 CET	49981	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:29.525774002 CET	11048	49981	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:30.005351067 CET	49981	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:30.124979019 CET	11048	49981	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:30.211236000 CET	49981	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:30.330722094 CET	11048	49981	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:30.330785036 CET	49981	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:30.450215101 CET	11048	49981	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:30.450263977 CET	49981	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:30.569782972 CET	11048	49981	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:30.569830894 CET	49981	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:30.689380884 CET	11048	49981	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:30.691230059 CET	11048	49981	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:30.691339970 CET	49981	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:30.810867071 CET	11048	49981	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:30.963009119 CET	49987	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:31.082623005 CET	11048	49987	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:31.082995892 CET	49987	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:31.160289049 CET	49987	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:31.279993057 CET	11048	49987	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:31.281394958 CET	49987	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:31.401037931 CET	11048	49987	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:31.401114941 CET	49987	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:31.521059990 CET	11048	49987	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:31.521137953 CET	49987	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:31.640795946 CET	11048	49987	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:31.640887976 CET	49987	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:31.760560036 CET	11048	49987	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:31.761564016 CET	49987	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:31.881107092 CET	11048	49987	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:31.881383896 CET	49987	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:32.001487017 CET	11048	49987	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:32.005491972 CET	49987	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:32.125045061 CET	11048	49987	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:32.125103951 CET	49987	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:32.244575024 CET	11048	49987	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:32.244676113 CET	49987	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:32.364176989 CET	11048	49987	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:32.365372896 CET	49987	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:32.474371910 CET	11048	49987	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:32.475461960 CET	49987	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:32.485323906 CET	11048	49987	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:32.597933054 CET	11048	49987	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:32.766062975 CET	49988	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:32.886789083 CET	11048	49988	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:32.886862993 CET	49988	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:33.219477892 CET	49988	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:33.339632034 CET	11048	49988	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:33.339728117 CET	49988	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:33.459810972 CET	11048	49988	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:33.459868908 CET	49988	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:33.580779076 CET	11048	49988	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:33.580833912 CET	49988	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:33.700994015 CET	11048	49988	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:33.701086044 CET	49988	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:33.820547104 CET	11048	49988	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:33.821629047 CET	49988	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:33.941279888 CET	11048	49988	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:33.942168951 CET	49988	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:34.061709881 CET	11048	49988	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:34.065416098 CET	49988	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:34.184966087 CET	11048	49988	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:34.185404062 CET	49988	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:34.268122911 CET	11048	49988	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:34.269659996 CET	49988	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:34.304896116 CET	11048	49988	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:34.389118910 CET	11048	49988	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:34.534805059 CET	49994	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:34.654594898 CET	11048	49994	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:34.657385111 CET	49994	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:34.706032038 CET	49994	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:34.825570107 CET	11048	49994	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:34.825762987 CET	49994	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:34.945367098 CET	11048	49994	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:34.946196079 CET	49994	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:35.066412926 CET	11048	49994	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:35.069880962 CET	49994	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:35.189465046 CET	11048	49994	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:35.193578005 CET	49994	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:35.313097000 CET	11048	49994	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:35.920593023 CET	49994	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:36.016124964 CET	11048	49994	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:36.016185045 CET	49994	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:36.040214062 CET	11048	49994	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:36.135972977 CET	11048	49994	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:36.244849920 CET	50000	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:36.364727020 CET	11048	50000	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:36.364815950 CET	50000	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:36.494679928 CET	50000	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:36.614245892 CET	11048	50000	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:36.614304066 CET	50000	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:36.733866930 CET	11048	50000	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:36.734534025 CET	50000	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:36.854125023 CET	11048	50000	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:36.858309984 CET	50000	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:36.978925943 CET	11048	50000	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:36.981379986 CET	50000	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:37.101028919 CET	11048	50000	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:37.101479053 CET	50000	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:37.221122980 CET	11048	50000	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:37.221198082 CET	50000	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:37.340724945 CET	11048	50000	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:37.343436956 CET	50000	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:37.463221073 CET	11048	50000	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:37.463288069 CET	50000	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:37.583024025 CET	11048	50000	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:37.583111048 CET	50000	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:37.702747107 CET	11048	50000	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:37.703052044 CET	50000	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:37.816992998 CET	11048	50000	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:37.817054987 CET	50000	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:37.822658062 CET	11048	50000	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:37.936583042 CET	11048	50000	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:38.028264999 CET	50004	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:38.147977114 CET	11048	50004	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:38.148061991 CET	50004	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:38.202244997 CET	50004	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:38.324212074 CET	11048	50004	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:38.324376106 CET	50004	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:38.444150925 CET	11048	50004	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:38.444215059 CET	50004	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:38.563951969 CET	11048	50004	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:38.564026117 CET	50004	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:38.683602095 CET	11048	50004	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:38.686316967 CET	50004	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:38.806035042 CET	11048	50004	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:38.810688019 CET	50004	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:38.930269003 CET	11048	50004	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:38.931050062 CET	50004	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:39.050699949 CET	11048	50004	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:39.050810099 CET	50004	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:39.170660019 CET	11048	50004	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:39.173666000 CET	50004	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:39.293292046 CET	11048	50004	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:39.295408010 CET	50004	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:39.415028095 CET	11048	50004	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:39.415416956 CET	50004	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:39.500722885 CET	11048	50004	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:39.500922918 CET	50004	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:39.534945011 CET	11048	50004	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:39.620455980 CET	11048	50004	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:39.697712898 CET	50007	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:39.817253113 CET	11048	50007	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:39.817400932 CET	50007	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:39.860100031 CET	50007	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:39.979619026 CET	11048	50007	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:39.979702950 CET	50007	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:40.099441051 CET	11048	50007	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:40.099558115 CET	50007	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:40.219049931 CET	11048	50007	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:40.219099998 CET	50007	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:40.338583946 CET	11048	50007	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:40.338646889 CET	50007	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:40.458095074 CET	11048	50007	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:40.458167076 CET	50007	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:40.577606916 CET	11048	50007	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:40.577653885 CET	50007	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:40.697287083 CET	11048	50007	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:40.697458029 CET	50007	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:40.817034006 CET	11048	50007	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:40.817692995 CET	50007	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:40.937578917 CET	11048	50007	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:40.937654972 CET	50007	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:41.057240009 CET	11048	50007	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:41.059529066 CET	50007	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:41.179459095 CET	11048	50007	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:41.181055069 CET	50007	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:41.256983042 CET	11048	50007	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:41.259510040 CET	50007	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:41.300741911 CET	11048	50007	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:41.379328012 CET	11048	50007	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:41.447715044 CET	50013	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:41.567401886 CET	11048	50013	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:41.569500923 CET	50013	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:41.610631943 CET	50013	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:41.730421066 CET	11048	50013	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:41.730588913 CET	50013	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:41.850080967 CET	11048	50013	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:41.850167036 CET	50013	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:41.969897985 CET	11048	50013	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:41.969974995 CET	50013	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:42.089605093 CET	11048	50013	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:42.089653015 CET	50013	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:42.209214926 CET	11048	50013	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:42.209268093 CET	50013	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:42.328867912 CET	11048	50013	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:42.328954935 CET	50013	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:42.448569059 CET	11048	50013	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:42.448673010 CET	50013	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:42.575414896 CET	11048	50013	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:42.575469017 CET	50013	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:42.695144892 CET	11048	50013	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:42.695215940 CET	50013	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:42.814759970 CET	11048	50013	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:42.814871073 CET	50013	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:42.935587883 CET	11048	50013	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:42.935738087 CET	50013	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:42.966749907 CET	11048	50013	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:42.966825008 CET	50013	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:43.055214882 CET	11048	50013	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:43.086523056 CET	11048	50013	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:43.143640995 CET	50019	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:43.263226986 CET	11048	50019	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:43.263293982 CET	50019	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:43.406959057 CET	50019	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:43.526545048 CET	11048	50019	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:43.526597977 CET	50019	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:43.646105051 CET	11048	50019	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:43.646215916 CET	50019	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:43.765693903 CET	11048	50019	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:43.765772104 CET	50019	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:43.885301113 CET	11048	50019	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:43.886408091 CET	50019	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:44.005840063 CET	11048	50019	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:44.005927086 CET	50019	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:44.125531912 CET	11048	50019	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:44.127408028 CET	50019	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:44.247040033 CET	11048	50019	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:44.249928951 CET	50019	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:44.369947910 CET	11048	50019	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:44.370770931 CET	50019	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:44.490292072 CET	11048	50019	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:44.493518114 CET	50019	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:44.613110065 CET	11048	50019	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:44.613163948 CET	50019	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:44.674293995 CET	11048	50019	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:44.674339056 CET	50019	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:44.732714891 CET	11048	50019	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:44.794028044 CET	11048	50019	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:44.846082926 CET	50024	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:44.965658903 CET	11048	50024	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:44.965842962 CET	50024	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:45.013923883 CET	50024	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:45.133456945 CET	11048	50024	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:45.133725882 CET	50024	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:45.253375053 CET	11048	50024	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:45.253448009 CET	50024	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:45.373406887 CET	11048	50024	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:45.406193972 CET	50024	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:45.525764942 CET	11048	50024	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:45.525811911 CET	50024	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:45.645401001 CET	11048	50024	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:45.645450115 CET	50024	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:45.765002966 CET	11048	50024	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:45.766431093 CET	50024	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:45.886058092 CET	11048	50024	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:45.886115074 CET	50024	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:46.005642891 CET	11048	50024	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:46.005707026 CET	50024	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:46.125300884 CET	11048	50024	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:46.125420094 CET	50024	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:46.245618105 CET	11048	50024	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:46.246397018 CET	50024	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:46.366162062 CET	11048	50024	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:46.366969109 CET	50024	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:46.384843111 CET	11048	50024	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:46.387496948 CET	50024	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:46.486610889 CET	11048	50024	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:46.506978035 CET	11048	50024	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:46.554702044 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:46.674278975 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:46.675429106 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:46.712683916 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:46.832456112 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:46.834716082 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:46.954193115 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:46.955169916 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:47.075042963 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:47.075089931 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:47.194580078 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:47.196851015 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:47.316476107 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:47.317389965 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:47.436937094 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:47.437530041 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:47.557239056 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:47.583008051 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:47.703303099 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:47.703346014 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:47.822907925 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:47.822979927 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:47.942478895 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:47.942538023 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:48.062211037 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:48.062304974 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:48.181780100 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:48.181967020 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:48.301428080 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:48.301594019 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:48.421133041 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:48.421375990 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:48.540826082 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:48.540910006 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:48.660938978 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:48.662108898 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:48.782267094 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:48.782335043 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:48.901901007 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:48.907413006 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:49.026967049 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:49.027491093 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:49.147034883 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:49.147099972 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:49.266974926 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:49.267019987 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:49.386554003 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:49.389429092 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:49.509232998 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:49.511404991 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:49.631047010 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:49.631541967 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:49.751168013 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:49.751226902 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:49.870912075 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:49.870974064 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:49.990590096 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:49.990797997 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:50.110625982 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:50.110801935 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:50.230941057 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:50.231055021 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:50.350651979 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:50.350709915 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:50.470343113 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:50.470392942 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:50.594904900 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:50.594960928 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:50.716500044 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:50.718456030 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:50.837971926 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:50.839412928 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:50.959060907 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:50.963423014 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:51.082998991 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:51.083503962 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:51.203075886 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:51.203387976 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:51.323163033 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:51.323412895 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:51.444206953 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:51.446435928 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:51.566106081 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:51.566521883 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:51.686275005 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:51.686326027 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:51.806042910 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:51.806102037 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:51.926167965 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:51.926208019 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:52.046297073 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:52.046510935 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:52.166094065 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:52.166265965 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:52.286113977 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:52.286225080 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:52.405801058 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:52.405890942 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:52.525434017 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:52.525505066 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:52.645073891 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:52.646420956 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:52.766321898 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:52.771440029 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:52.891016006 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:52.891453981 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:53.011308908 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:53.011392117 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:53.130961895 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:53.131038904 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:53.250824928 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:53.253563881 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:53.373281956 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:53.374496937 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:53.494184971 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:53.494435072 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:53.614048958 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:53.614537954 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:53.734360933 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:53.734416962 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:53.854123116 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:53.854208946 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:53.973891020 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:53.974040985 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:54.093637943 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:54.093755007 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:54.213483095 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:54.213577986 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:54.334033966 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:54.334099054 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:54.453938007 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:54.454003096 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:54.573965073 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:54.574065924 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:54.693701982 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:54.695498943 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:54.815149069 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:54.815454960 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:54.935072899 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:54.935431004 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:55.054980040 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:55.055064917 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:55.174597025 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:55.175441027 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:55.295155048 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:55.295440912 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:55.415499926 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:55.415756941 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:55.536274910 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:55.536412001 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:55.656100035 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:55.656168938 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:55.775882006 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:55.775999069 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:55.895562887 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:55.895688057 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:56.015516996 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:56.015652895 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:56.135207891 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:56.135262012 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:56.254976988 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:56.255059004 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:56.380584955 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:56.380711079 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:56.500572920 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:56.500654936 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:56.620381117 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:56.620655060 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:56.740331888 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:56.740452051 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:56.860290051 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:56.860375881 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:56.980189085 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:56.980261087 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:57.100176096 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:57.100346088 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:57.219955921 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:57.220032930 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:57.339979887 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:57.340286016 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:57.459867001 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:57.459954023 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:57.580030918 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:57.580138922 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:57.699805975 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:57.721025944 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:57.840820074 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:57.840890884 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:57.960460901 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:58.429656029 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:58.622092009 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:58.622325897 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:58.743259907 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:59.186209917 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:59.305944920 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:59.306013107 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:59.425791025 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:59.425965071 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:59.545584917 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:59.545805931 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:59.665416956 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:59.665606976 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:59.785094023 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:59.785145044 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:09:59.904705048 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:09:59.904803038 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:00.024287939 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:00.024389029 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:00.143872023 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:00.144062042 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:00.263747931 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:00.263824940 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:00.383635044 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:00.468305111 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:00.587999105 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:00.588093996 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:00.707576990 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:00.711452961 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:00.830991983 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:00.831609964 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:00.951224089 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:00.951523066 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:01.071116924 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:01.071425915 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:01.191119909 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:01.191531897 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:01.311104059 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:01.467690945 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:01.587680101 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:01.589596033 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:01.709361076 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:02.114700079 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:02.234316111 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:02.234412909 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:02.354279995 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:02.354360104 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:02.473947048 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:02.473999023 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:02.593523026 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:02.593571901 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:02.713080883 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:02.713460922 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:02.833017111 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:02.833470106 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:02.953232050 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:02.953449965 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:03.072997093 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:03.073472977 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:03.193110943 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:03.193200111 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:03.312779903 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:03.313457012 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:03.433929920 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:03.439445972 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:03.558983088 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:03.559456110 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:03.679738998 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:03.679800987 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:03.799415112 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:03.799484015 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:03.919085026 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:03.919161081 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:04.038796902 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:04.038871050 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:04.158582926 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:04.158653975 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:04.278394938 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:04.278578043 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:04.398299932 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:04.775310040 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:05.047251940 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:05.047336102 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:05.171164036 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:05.171222925 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:05.290844917 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:05.290916920 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:05.410461903 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:05.410598040 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:05.530126095 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:05.530272961 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:05.649842024 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:05.649976015 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:05.769676924 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:05.771138906 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:05.792339087 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:05.792853117 CET	50026	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:05.890913010 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:05.912528038 CET	11048	50026	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:05.932120085 CET	50057	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:06.051734924 CET	11048	50057	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:06.054466963 CET	50057	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:06.095865965 CET	50057	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:06.215625048 CET	11048	50057	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:06.217505932 CET	50057	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:06.337097883 CET	11048	50057	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:06.337480068 CET	50057	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:06.457027912 CET	11048	50057	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:06.457086086 CET	50057	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:06.805452108 CET	11048	50057	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:06.805531979 CET	50057	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:06.925265074 CET	11048	50057	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:06.925354004 CET	50057	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:07.044966936 CET	11048	50057	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:07.045027018 CET	50057	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:07.165967941 CET	11048	50057	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:07.166014910 CET	50057	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:07.285605907 CET	11048	50057	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:07.285795927 CET	50057	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:07.405445099 CET	11048	50057	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:07.405508995 CET	50057	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:07.525207996 CET	11048	50057	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:07.525398016 CET	50057	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:07.644994974 CET	11048	50057	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:07.645051956 CET	50057	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:07.764676094 CET	11048	50057	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:07.764770985 CET	50057	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:07.884522915 CET	11048	50057	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:07.884598017 CET	50057	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:08.004326105 CET	11048	50057	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:08.004390001 CET	50057	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:08.124094963 CET	11048	50057	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:08.124154091 CET	50057	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:08.243833065 CET	11048	50057	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:08.243958950 CET	50057	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:08.312725067 CET	11048	50057	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:08.312802076 CET	50057	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:08.363496065 CET	11048	50057	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:08.432842016 CET	11048	50057	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:08.447758913 CET	50058	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:08.567359924 CET	11048	50058	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:08.567435980 CET	50058	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:08.756066084 CET	50058	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:08.875682116 CET	11048	50058	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:08.875853062 CET	50058	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:08.995474100 CET	11048	50058	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:08.997467041 CET	50058	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:09.117012024 CET	11048	50058	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:09.117070913 CET	50058	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:09.236670017 CET	11048	50058	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:09.236773968 CET	50058	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:09.356326103 CET	11048	50058	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:09.359460115 CET	50058	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:09.479142904 CET	11048	50058	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:09.479435921 CET	50058	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:09.598998070 CET	11048	50058	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:09.599442005 CET	50058	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:09.719899893 CET	11048	50058	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:09.720503092 CET	50058	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:09.840401888 CET	11048	50058	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:09.842458963 CET	50058	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:09.962006092 CET	11048	50058	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:09.962308884 CET	50058	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:10.082142115 CET	11048	50058	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:10.083436966 CET	50058	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:10.203262091 CET	11048	50058	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:10.203540087 CET	50058	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:10.323108912 CET	11048	50058	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:10.325598001 CET	50058	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:10.445312977 CET	11048	50058	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:10.446470976 CET	50058	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:10.566063881 CET	11048	50058	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:10.566602945 CET	50058	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:10.686304092 CET	11048	50058	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:10.686377048 CET	50058	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:10.805990934 CET	11048	50058	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:10.806046963 CET	50058	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:10.812503099 CET	11048	50058	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:10.812555075 CET	50058	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:10.925672054 CET	11048	50058	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:10.932158947 CET	11048	50058	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:10.947693110 CET	50059	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:11.067331076 CET	11048	50059	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:11.067470074 CET	50059	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:11.120477915 CET	50059	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:11.240084887 CET	11048	50059	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:11.240199089 CET	50059	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:11.359821081 CET	11048	50059	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:11.359935045 CET	50059	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:11.479564905 CET	11048	50059	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:11.479688883 CET	50059	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:11.599371910 CET	11048	50059	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:11.599503994 CET	50059	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:11.719245911 CET	11048	50059	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:11.719316959 CET	50059	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:11.839027882 CET	11048	50059	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:11.839087009 CET	50059	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:12.306328058 CET	50059	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:12.364345074 CET	11048	50059	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:12.364437103 CET	50059	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:12.426012039 CET	11048	50059	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:12.484038115 CET	11048	50059	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:12.484127045 CET	50059	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:12.603806019 CET	11048	50059	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:12.603971004 CET	50059	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:12.723550081 CET	11048	50059	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:12.727478981 CET	50059	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:12.847028017 CET	11048	50059	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:12.847476959 CET	50059	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:12.968682051 CET	11048	50059	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:12.970464945 CET	50059	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:13.090297937 CET	11048	50059	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:13.090482950 CET	50059	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:13.210133076 CET	11048	50059	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:13.211077929 CET	50059	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:13.271961927 CET	11048	50059	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:13.272123098 CET	50059	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:13.331350088 CET	11048	50059	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:13.384197950 CET	50059	11048	192.168.2.4	18.197.239.5
Dec 28, 2024 21:10:13.392260075 CET	11048	50059	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:13.505248070 CET	11048	50059	18.197.239.5	192.168.2.4
Dec 28, 2024 21:10:13.900590897 CET	50060	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:14.020273924 CET	11048	50060	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:14.020387888 CET	50060	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:14.064611912 CET	50060	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:14.184171915 CET	11048	50060	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:14.184273958 CET	50060	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:14.303924084 CET	11048	50060	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:14.304006100 CET	50060	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:14.423665047 CET	11048	50060	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:14.423724890 CET	50060	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:14.543265104 CET	11048	50060	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:14.543337107 CET	50060	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:14.663923979 CET	11048	50060	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:14.663980961 CET	50060	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:14.783560991 CET	11048	50060	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:14.786465883 CET	50060	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:14.906076908 CET	11048	50060	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:14.906466961 CET	50060	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:15.026017904 CET	11048	50060	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:15.026454926 CET	50060	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:15.146011114 CET	11048	50060	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:15.534161091 CET	50060	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:15.653791904 CET	11048	50060	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:15.657603979 CET	50060	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:15.777283907 CET	11048	50060	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:15.777338982 CET	50060	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:15.897034883 CET	11048	50060	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:15.897119045 CET	50060	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:16.016834021 CET	11048	50060	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:16.016896963 CET	50060	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:16.136954069 CET	11048	50060	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:16.137172937 CET	50060	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:16.233136892 CET	11048	50060	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:16.233198881 CET	50060	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:16.256767035 CET	11048	50060	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:16.337426901 CET	50060	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:16.338340044 CET	50061	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:16.352837086 CET	11048	50060	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:16.457031012 CET	11048	50060	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:16.457905054 CET	11048	50061	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:16.458007097 CET	50061	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:16.496582031 CET	50061	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:16.616348982 CET	11048	50061	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:16.616420031 CET	50061	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:16.736150026 CET	11048	50061	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:16.736216068 CET	50061	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:16.855894089 CET	11048	50061	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:16.855969906 CET	50061	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:16.975698948 CET	11048	50061	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:16.975835085 CET	50061	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:17.095674038 CET	11048	50061	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:17.095895052 CET	50061	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:17.215918064 CET	11048	50061	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:17.216149092 CET	50061	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:17.335942984 CET	11048	50061	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:17.336184978 CET	50061	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:17.456029892 CET	11048	50061	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:17.456084013 CET	50061	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:17.575757980 CET	11048	50061	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:17.575855970 CET	50061	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:17.695585012 CET	11048	50061	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:17.695686102 CET	50061	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:17.815386057 CET	11048	50061	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:17.819595098 CET	50061	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:17.939234018 CET	11048	50061	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:18.429989100 CET	50061	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:18.550522089 CET	11048	50061	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:18.550630093 CET	50061	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:18.670548916 CET	11048	50061	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:18.670665026 CET	50061	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:18.703632116 CET	11048	50061	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:18.703694105 CET	50061	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:18.790513992 CET	11048	50061	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:18.808182955 CET	50061	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:18.811340094 CET	50062	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:18.823472977 CET	11048	50061	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:18.928239107 CET	11048	50061	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:18.931154966 CET	11048	50062	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:18.931224108 CET	50062	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:18.997271061 CET	50062	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:19.117234945 CET	11048	50062	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:19.117296934 CET	50062	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:19.237183094 CET	11048	50062	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:19.237339973 CET	50062	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:19.357037067 CET	11048	50062	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:19.411149025 CET	50062	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:19.531014919 CET	11048	50062	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:19.531085968 CET	50062	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:19.650958061 CET	11048	50062	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:19.651051044 CET	50062	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:19.770976067 CET	11048	50062	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:19.771490097 CET	50062	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:19.896136999 CET	11048	50062	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:19.896634102 CET	50062	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:20.016429901 CET	11048	50062	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:20.019571066 CET	50062	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:20.139240026 CET	11048	50062	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:20.139308929 CET	50062	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:20.258945942 CET	11048	50062	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:20.259470940 CET	50062	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:20.379091024 CET	11048	50062	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:20.379461050 CET	50062	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:20.499264002 CET	11048	50062	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:20.499418020 CET	50062	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:20.619021893 CET	11048	50062	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:20.619476080 CET	50062	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:20.739145994 CET	11048	50062	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:20.739212990 CET	50062	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:20.858932972 CET	11048	50062	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:20.859018087 CET	50062	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:20.978842974 CET	11048	50062	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:20.978923082 CET	50062	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:21.098742962 CET	11048	50062	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:21.098814011 CET	50062	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:21.102672100 CET	11048	50062	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:21.102734089 CET	50062	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:21.196693897 CET	50062	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:21.197612047 CET	50063	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:21.218597889 CET	11048	50062	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:21.222326994 CET	11048	50062	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:21.316251040 CET	11048	50062	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:21.317282915 CET	11048	50063	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:21.317365885 CET	50063	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:21.380181074 CET	50063	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:21.500122070 CET	11048	50063	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:21.500255108 CET	50063	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:21.619856119 CET	11048	50063	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:21.619910002 CET	50063	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:21.739959002 CET	11048	50063	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:21.740019083 CET	50063	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:21.860749006 CET	11048	50063	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:21.860800028 CET	50063	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:21.980592966 CET	11048	50063	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:21.980664968 CET	50063	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:22.100564003 CET	11048	50063	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:22.100635052 CET	50063	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:22.220357895 CET	11048	50063	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:22.220447063 CET	50063	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:22.340186119 CET	11048	50063	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:22.340248108 CET	50063	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:22.459952116 CET	11048	50063	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:22.460033894 CET	50063	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:22.581064939 CET	11048	50063	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:22.581157923 CET	50063	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:22.700812101 CET	11048	50063	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:22.700958014 CET	50063	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:22.820591927 CET	11048	50063	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:22.821482897 CET	50063	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:22.941174030 CET	11048	50063	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:22.941565037 CET	50063	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:23.061311007 CET	11048	50063	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:23.061398029 CET	50063	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:23.181015968 CET	11048	50063	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:23.181077957 CET	50063	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:23.300708055 CET	11048	50063	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:23.301660061 CET	50063	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:23.421842098 CET	11048	50063	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:23.422343016 CET	50063	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:23.522744894 CET	11048	50063	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:23.524851084 CET	50063	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:23.541925907 CET	11048	50063	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:23.618562937 CET	50063	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:23.619908094 CET	50064	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:23.644596100 CET	11048	50063	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:23.738151073 CET	11048	50063	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:23.739443064 CET	11048	50064	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:23.739505053 CET	50064	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:23.833271027 CET	50064	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:23.952841997 CET	11048	50064	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:23.952958107 CET	50064	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:24.073654890 CET	11048	50064	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:24.073729992 CET	50064	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:24.194849968 CET	11048	50064	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:24.194974899 CET	50064	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:24.314552069 CET	11048	50064	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:24.314600945 CET	50064	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:24.434170008 CET	11048	50064	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:24.434308052 CET	50064	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:24.554270029 CET	11048	50064	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:24.554394007 CET	50064	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:24.674240112 CET	11048	50064	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:24.674293995 CET	50064	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:24.794060946 CET	11048	50064	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:25.339329004 CET	50064	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:25.459175110 CET	11048	50064	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:25.459232092 CET	50064	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:25.578861952 CET	11048	50064	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:25.581512928 CET	50064	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:25.701215029 CET	11048	50064	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:25.701771975 CET	50064	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:25.821623087 CET	11048	50064	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:25.825550079 CET	50064	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:25.945180893 CET	11048	50064	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:25.945241928 CET	11048	50064	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:25.945300102 CET	50064	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:26.024795055 CET	50064	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:26.025629997 CET	50065	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:26.064811945 CET	11048	50064	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:26.144557953 CET	11048	50064	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:26.145340919 CET	11048	50065	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:26.145437956 CET	50065	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:26.223684072 CET	50065	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:26.343473911 CET	11048	50065	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:26.343988895 CET	50065	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:26.463664055 CET	11048	50065	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:26.464154005 CET	50065	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:26.583750010 CET	11048	50065	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:26.584655046 CET	50065	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:26.704355001 CET	11048	50065	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:26.704406977 CET	50065	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:26.824044943 CET	11048	50065	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:26.824202061 CET	50065	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:26.943958998 CET	11048	50065	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:26.944045067 CET	50065	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:27.063661098 CET	11048	50065	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:27.063739061 CET	50065	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:27.183332920 CET	11048	50065	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:27.183423042 CET	50065	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:27.303076029 CET	11048	50065	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:27.303282976 CET	50065	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:27.422884941 CET	11048	50065	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:27.422949076 CET	50065	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:27.542610884 CET	11048	50065	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:28.068402052 CET	50065	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:28.188148975 CET	11048	50065	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:28.188245058 CET	50065	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:28.307904959 CET	11048	50065	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:28.308137894 CET	50065	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:28.381251097 CET	11048	50065	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:28.381309032 CET	50065	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:28.427815914 CET	11048	50065	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:28.462435007 CET	50065	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:28.464998960 CET	50066	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:28.501059055 CET	11048	50065	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:28.581963062 CET	11048	50065	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:28.584708929 CET	11048	50066	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:28.584790945 CET	50066	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:28.631108999 CET	50066	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:28.750767946 CET	11048	50066	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:28.750827074 CET	50066	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:28.871617079 CET	11048	50066	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:28.871705055 CET	50066	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:28.991358042 CET	11048	50066	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:28.993546009 CET	50066	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:29.113094091 CET	11048	50066	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:29.114033937 CET	50066	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:29.233655930 CET	11048	50066	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:29.236382961 CET	50066	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:29.355995893 CET	11048	50066	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:29.357696056 CET	50066	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:29.477797985 CET	11048	50066	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:29.477974892 CET	50066	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:29.597821951 CET	11048	50066	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:29.601681948 CET	50066	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:29.721257925 CET	11048	50066	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:29.721792936 CET	50066	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:29.841510057 CET	11048	50066	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:29.841568947 CET	50066	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:29.961834908 CET	11048	50066	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:29.961956024 CET	50066	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:30.081628084 CET	11048	50066	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:30.081729889 CET	50066	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:30.201355934 CET	11048	50066	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:30.201409101 CET	50066	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:30.321021080 CET	11048	50066	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:30.321096897 CET	50066	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:30.440867901 CET	11048	50066	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:30.440952063 CET	50066	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:30.560532093 CET	11048	50066	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:30.560756922 CET	50066	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:30.681802034 CET	11048	50066	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:30.681864023 CET	50066	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:30.801450968 CET	11048	50066	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:30.801687956 CET	50066	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:30.921338081 CET	11048	50066	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:30.921487093 CET	50066	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:31.041074991 CET	11048	50066	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:31.041125059 CET	50066	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:31.327989101 CET	11048	50066	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:31.328066111 CET	50066	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:31.328592062 CET	11048	50066	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:31.352900982 CET	50066	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:31.400213957 CET	50066	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:31.401273012 CET	50067	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:31.447685003 CET	11048	50066	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:31.472465992 CET	11048	50066	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:31.519954920 CET	11048	50066	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:31.520831108 CET	11048	50067	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:31.520894051 CET	50067	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:31.670986891 CET	50067	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:31.790646076 CET	11048	50067	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:31.790719032 CET	50067	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:31.910348892 CET	11048	50067	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:31.910417080 CET	50067	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:32.030549049 CET	11048	50067	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:32.030659914 CET	50067	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:32.150223017 CET	11048	50067	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:32.150302887 CET	50067	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:32.269948959 CET	11048	50067	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:32.270025969 CET	50067	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:32.389687061 CET	11048	50067	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:32.907999992 CET	11048	50067	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:32.908062935 CET	50067	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:32.978169918 CET	50067	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:32.979680061 CET	50068	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:33.098016977 CET	11048	50067	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:33.099361897 CET	11048	50068	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:33.099457026 CET	50068	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:33.140094042 CET	50068	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:33.259737968 CET	11048	50068	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:33.259962082 CET	50068	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:33.379846096 CET	11048	50068	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:33.379965067 CET	50068	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:33.499593019 CET	11048	50068	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:33.499789953 CET	50068	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:33.619462967 CET	11048	50068	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:33.619527102 CET	50068	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:33.739185095 CET	11048	50068	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:33.739348888 CET	50068	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:33.858990908 CET	11048	50068	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:33.859042883 CET	50068	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:33.978672028 CET	11048	50068	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:33.978802919 CET	50068	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:34.098664999 CET	11048	50068	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:34.101656914 CET	50068	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:34.221278906 CET	11048	50068	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:34.221579075 CET	50068	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:34.341187954 CET	11048	50068	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:34.341516972 CET	50068	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:34.461512089 CET	11048	50068	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:34.461719990 CET	50068	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:34.503077984 CET	11048	50068	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:34.505779028 CET	50068	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:34.571942091 CET	50068	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:34.572746992 CET	50069	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:34.581224918 CET	11048	50068	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:34.625315905 CET	11048	50068	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:34.691504955 CET	11048	50068	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:34.692291975 CET	11048	50069	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:34.692483902 CET	50069	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:34.823235989 CET	50069	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:34.942841053 CET	11048	50069	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:34.942902088 CET	50069	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:35.062484026 CET	11048	50069	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:35.688276052 CET	50069	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:35.807890892 CET	11048	50069	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:35.807948112 CET	50069	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:35.927480936 CET	11048	50069	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:35.927529097 CET	50069	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:36.047632933 CET	11048	50069	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:36.047718048 CET	50069	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:36.048717976 CET	11048	50069	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:36.048870087 CET	50069	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:36.130934954 CET	50069	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:36.135719061 CET	50070	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:36.167396069 CET	11048	50069	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:36.168241978 CET	11048	50069	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:36.250447989 CET	11048	50069	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:36.255386114 CET	11048	50070	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:36.255455971 CET	50070	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:36.299021006 CET	50070	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:36.418555021 CET	11048	50070	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:36.418746948 CET	50070	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:36.538333893 CET	11048	50070	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:36.538554907 CET	50070	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:36.658094883 CET	11048	50070	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:36.658261061 CET	50070	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:36.777786970 CET	11048	50070	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:36.777848005 CET	50070	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:36.897382021 CET	11048	50070	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:36.897471905 CET	50070	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:37.017033100 CET	11048	50070	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:37.017546892 CET	50070	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:37.137070894 CET	11048	50070	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:37.137682915 CET	50070	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:37.257669926 CET	11048	50070	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:37.257730961 CET	50070	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:37.377454996 CET	11048	50070	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:37.377933025 CET	50070	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:37.497569084 CET	11048	50070	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:37.499512911 CET	50070	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:37.619209051 CET	11048	50070	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:37.619618893 CET	50070	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:37.670499086 CET	11048	50070	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:37.671626091 CET	50070	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:37.728307962 CET	50070	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:37.729193926 CET	50071	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:37.739164114 CET	11048	50070	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:37.791382074 CET	11048	50070	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:37.847966909 CET	11048	50070	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:37.848820925 CET	11048	50071	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:37.848910093 CET	50071	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:38.584286928 CET	50071	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:38.703979015 CET	11048	50071	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:38.707529068 CET	50071	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:38.827157974 CET	11048	50071	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:38.827224970 CET	50071	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:38.946815014 CET	11048	50071	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:38.946871042 CET	50071	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:39.066627026 CET	11048	50071	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:39.066751957 CET	50071	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:39.186346054 CET	11048	50071	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:39.186402082 CET	50071	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:39.214771986 CET	11048	50071	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:39.214842081 CET	50071	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:39.275475979 CET	50071	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:39.276525021 CET	50072	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:39.305921078 CET	11048	50071	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:39.334472895 CET	11048	50071	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:39.395032883 CET	11048	50071	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:39.396264076 CET	11048	50072	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:39.396346092 CET	50072	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:39.484266996 CET	50072	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:39.603972912 CET	11048	50072	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:39.604032993 CET	50072	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:39.723618984 CET	11048	50072	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:39.723670959 CET	50072	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:39.843355894 CET	11048	50072	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:40.133647919 CET	50072	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:40.253462076 CET	11048	50072	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:40.255408049 CET	50072	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:40.375258923 CET	11048	50072	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:40.375617981 CET	50072	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:40.495264053 CET	11048	50072	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:40.498353004 CET	50072	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:40.618093014 CET	11048	50072	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:40.618769884 CET	50072	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:40.738385916 CET	11048	50072	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:40.854749918 CET	11048	50072	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:40.854824066 CET	50072	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:40.926306009 CET	50072	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:40.928031921 CET	50073	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:41.046555042 CET	11048	50072	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:41.048209906 CET	11048	50073	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:41.048316956 CET	50073	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:41.410969019 CET	50073	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:41.531660080 CET	11048	50073	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:41.531747103 CET	50073	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:41.651428938 CET	11048	50073	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:41.651650906 CET	50073	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:41.771400928 CET	11048	50073	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:41.771543980 CET	50073	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:41.891340971 CET	11048	50073	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:41.891392946 CET	50073	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:42.011271000 CET	11048	50073	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:42.011326075 CET	50073	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:42.130961895 CET	11048	50073	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:42.131009102 CET	50073	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:42.250809908 CET	11048	50073	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:42.258183002 CET	50073	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:42.377767086 CET	11048	50073	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:42.377872944 CET	50073	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:42.497438908 CET	11048	50073	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:42.497661114 CET	50073	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:42.504704952 CET	11048	50073	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:42.504798889 CET	50073	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:42.556471109 CET	50073	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:42.560480118 CET	50074	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:42.617376089 CET	11048	50073	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:42.624336004 CET	11048	50073	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:42.676328897 CET	11048	50073	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:42.680322886 CET	11048	50074	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:42.680418015 CET	50074	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:42.743875027 CET	50074	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:42.863821983 CET	11048	50074	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:42.863887072 CET	50074	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:42.983731985 CET	11048	50074	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:42.983800888 CET	50074	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:43.103578091 CET	11048	50074	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:43.105560064 CET	50074	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:43.226800919 CET	11048	50074	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:43.226881981 CET	50074	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:43.346779108 CET	11048	50074	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:43.347647905 CET	50074	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:43.467293978 CET	11048	50074	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:43.467551947 CET	50074	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:43.587446928 CET	11048	50074	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:43.587517977 CET	50074	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:43.707257032 CET	11048	50074	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:43.707504034 CET	50074	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:43.827157021 CET	11048	50074	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:43.827275991 CET	50074	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:43.948827982 CET	11048	50074	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:43.948991060 CET	50074	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:44.037527084 CET	11048	50074	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:44.037609100 CET	50074	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:44.068718910 CET	11048	50074	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:44.087776899 CET	50074	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:44.088644981 CET	50075	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:44.157159090 CET	11048	50074	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:44.207415104 CET	11048	50074	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:44.208179951 CET	11048	50075	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:44.208818913 CET	50075	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:44.261785984 CET	50075	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:44.381576061 CET	11048	50075	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:44.381638050 CET	50075	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:44.501502991 CET	11048	50075	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:44.501614094 CET	50075	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:44.621455908 CET	11048	50075	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:44.621644974 CET	50075	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:44.741245031 CET	11048	50075	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:44.741445065 CET	50075	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:44.861143112 CET	11048	50075	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:44.861196995 CET	50075	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:44.980914116 CET	11048	50075	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:44.980967999 CET	50075	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:45.100900888 CET	11048	50075	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:45.101032972 CET	50075	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:45.220822096 CET	11048	50075	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:45.220873117 CET	50075	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:45.340673923 CET	11048	50075	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:45.340935946 CET	50075	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:45.460544109 CET	11048	50075	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:45.460659027 CET	50075	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:45.580311060 CET	11048	50075	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:45.580416918 CET	50075	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:45.661669970 CET	11048	50075	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:45.661897898 CET	50075	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:45.700053930 CET	11048	50075	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:45.713849068 CET	50075	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:45.715651035 CET	50076	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:45.781620979 CET	11048	50075	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:45.833514929 CET	11048	50075	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:45.835273981 CET	11048	50076	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:45.835345984 CET	50076	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:45.886881113 CET	50076	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:46.006628990 CET	11048	50076	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:46.006719112 CET	50076	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:46.126519918 CET	11048	50076	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:46.126718998 CET	50076	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:46.246351957 CET	11048	50076	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:46.246546030 CET	50076	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:46.366235971 CET	11048	50076	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:46.366292000 CET	50076	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:46.486175060 CET	11048	50076	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:46.486238003 CET	50076	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:46.606172085 CET	11048	50076	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:46.606221914 CET	50076	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:46.725799084 CET	11048	50076	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:46.726025105 CET	50076	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:46.845580101 CET	11048	50076	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:46.845657110 CET	50076	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:46.965414047 CET	11048	50076	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:46.965466022 CET	50076	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:47.085068941 CET	11048	50076	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:47.085182905 CET	50076	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:47.204943895 CET	11048	50076	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:47.205192089 CET	50076	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:47.298939943 CET	11048	50076	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:47.299210072 CET	50076	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:47.324765921 CET	11048	50076	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:47.337472916 CET	50076	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:47.338242054 CET	50077	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:47.418843031 CET	11048	50076	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:47.457078934 CET	11048	50076	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:47.457726002 CET	11048	50077	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:47.457802057 CET	50077	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:47.571861029 CET	50077	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:47.691566944 CET	11048	50077	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:47.691668987 CET	50077	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:47.811460018 CET	11048	50077	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:47.814692974 CET	50077	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:47.934425116 CET	11048	50077	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:47.934477091 CET	50077	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:48.054114103 CET	11048	50077	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:48.054533958 CET	50077	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:48.174268961 CET	11048	50077	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:48.175632000 CET	50077	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:48.295301914 CET	11048	50077	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:48.295387983 CET	50077	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:48.415338993 CET	11048	50077	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:48.415402889 CET	50077	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:48.535240889 CET	11048	50077	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:48.535559893 CET	50077	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:48.655106068 CET	11048	50077	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:48.655525923 CET	50077	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:48.775228024 CET	11048	50077	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:48.775367975 CET	50077	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:48.896166086 CET	11048	50077	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:48.896245003 CET	50077	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:48.899672985 CET	11048	50077	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:48.899844885 CET	50077	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:48.946753025 CET	50077	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:48.947611094 CET	50078	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:49.015892982 CET	11048	50077	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:49.019375086 CET	11048	50077	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:49.066504002 CET	11048	50077	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:49.067188025 CET	11048	50078	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:49.067275047 CET	50078	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:49.117583036 CET	50078	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:49.238253117 CET	11048	50078	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:49.238518000 CET	50078	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:49.358136892 CET	11048	50078	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:49.358211994 CET	50078	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:49.483206034 CET	11048	50078	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:49.483251095 CET	50078	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:49.602782965 CET	11048	50078	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:49.602828979 CET	50078	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:49.722388029 CET	11048	50078	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:49.722462893 CET	50078	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:49.843472958 CET	11048	50078	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:49.843683958 CET	50078	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:49.963264942 CET	11048	50078	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:49.963315964 CET	50078	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:50.082891941 CET	11048	50078	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:50.082969904 CET	50078	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:50.202730894 CET	11048	50078	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:50.202774048 CET	50078	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:50.322341919 CET	11048	50078	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:50.322406054 CET	50078	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:50.442171097 CET	11048	50078	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:50.442243099 CET	50078	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:50.465213060 CET	11048	50078	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:50.465289116 CET	50078	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:50.509424925 CET	50078	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:50.510396004 CET	50079	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:50.561794043 CET	11048	50078	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:50.584978104 CET	11048	50078	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:50.628994942 CET	11048	50078	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:50.629950047 CET	11048	50079	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:50.630028009 CET	50079	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:50.688877106 CET	50079	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:50.808427095 CET	11048	50079	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:50.809114933 CET	50079	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:50.929136038 CET	11048	50079	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:50.929236889 CET	50079	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:51.048769951 CET	11048	50079	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:51.048827887 CET	50079	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:51.169023037 CET	11048	50079	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:51.169728994 CET	50079	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:51.289385080 CET	11048	50079	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:51.289556980 CET	50079	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:51.409239054 CET	11048	50079	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:51.409456015 CET	50079	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:51.529095888 CET	11048	50079	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:51.531553984 CET	50079	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:51.651305914 CET	11048	50079	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:51.651568890 CET	50079	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:51.771272898 CET	11048	50079	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:51.771564960 CET	50079	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:51.891084909 CET	11048	50079	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:51.891552925 CET	50079	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:52.012008905 CET	11048	50079	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:52.012453079 CET	50079	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:52.015861988 CET	11048	50079	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:52.015913963 CET	50079	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:52.056269884 CET	50079	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:52.057162046 CET	50080	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:52.131972075 CET	11048	50079	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:52.135513067 CET	11048	50079	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:52.176006079 CET	11048	50079	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:52.176651001 CET	11048	50080	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:52.176762104 CET	50080	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:52.219293118 CET	50080	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:52.338849068 CET	11048	50080	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:52.343560934 CET	50080	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:52.463129997 CET	11048	50080	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:52.463567972 CET	50080	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:52.583081007 CET	11048	50080	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:52.584530115 CET	50080	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:52.704343081 CET	11048	50080	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:52.707654953 CET	50080	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:52.827234030 CET	11048	50080	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:52.827286005 CET	50080	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:52.947443962 CET	11048	50080	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:52.947499037 CET	50080	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:53.067029953 CET	11048	50080	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:53.067079067 CET	50080	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:53.186691999 CET	11048	50080	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:53.186815977 CET	50080	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:53.306411028 CET	11048	50080	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:53.306598902 CET	50080	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:53.426151037 CET	11048	50080	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:53.426359892 CET	50080	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:53.546027899 CET	11048	50080	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:53.546231031 CET	50080	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:53.641638041 CET	11048	50080	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:53.641834974 CET	50080	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:53.665993929 CET	11048	50080	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:53.681404114 CET	50080	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:53.682734013 CET	50081	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:53.761416912 CET	11048	50080	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:53.800966024 CET	11048	50080	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:53.802385092 CET	11048	50081	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:53.802500963 CET	50081	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:53.853638887 CET	50081	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:53.973136902 CET	11048	50081	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:53.973191023 CET	50081	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:54.092928886 CET	11048	50081	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:54.092992067 CET	50081	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:54.212503910 CET	11048	50081	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:54.212570906 CET	50081	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:54.332098961 CET	11048	50081	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:54.332181931 CET	50081	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:54.451695919 CET	11048	50081	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:54.451749086 CET	50081	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:54.571369886 CET	11048	50081	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:54.571465969 CET	50081	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:54.690941095 CET	11048	50081	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:54.691545963 CET	50081	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:54.811291933 CET	11048	50081	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:54.811381102 CET	50081	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:54.930993080 CET	11048	50081	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:54.931061983 CET	50081	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:55.051508904 CET	11048	50081	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:55.051644087 CET	50081	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:55.171303034 CET	11048	50081	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:55.171583891 CET	50081	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:55.188807011 CET	11048	50081	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:55.188993931 CET	50081	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:55.228017092 CET	50081	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:55.228903055 CET	50082	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:55.291145086 CET	11048	50081	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:55.308635950 CET	11048	50081	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:55.347513914 CET	11048	50081	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:55.348447084 CET	11048	50082	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:55.348553896 CET	50082	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:55.420698881 CET	50082	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:55.540189981 CET	11048	50082	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:55.540312052 CET	50082	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:55.660695076 CET	11048	50082	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:55.660778999 CET	50082	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:55.781352997 CET	11048	50082	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:55.781409025 CET	50082	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:55.900933981 CET	11048	50082	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:55.900985956 CET	50082	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:56.306147099 CET	50082	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:56.522696018 CET	11048	50082	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:56.522711039 CET	11048	50082	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:56.522851944 CET	50082	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:56.642461061 CET	11048	50082	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:56.642519951 CET	50082	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:56.710838079 CET	11048	50082	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:56.710942984 CET	50082	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:56.744002104 CET	50082	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:56.745285034 CET	50083	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:56.762059927 CET	11048	50082	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:56.830506086 CET	11048	50082	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:56.863593102 CET	11048	50082	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:56.864988089 CET	11048	50083	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:56.865089893 CET	50083	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:56.916318893 CET	50083	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:57.035960913 CET	11048	50083	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:57.036010981 CET	50083	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:57.155725002 CET	11048	50083	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:58.279037952 CET	11048	50083	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:58.282668114 CET	50083	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:58.887828112 CET	50083	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:58.897752047 CET	50084	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:59.007457972 CET	11048	50083	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:59.017352104 CET	11048	50084	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:59.017419100 CET	50084	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:59.130079985 CET	50084	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:59.249630928 CET	11048	50084	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:59.249840975 CET	50084	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:59.369591951 CET	11048	50084	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:59.369649887 CET	50084	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:59.489156961 CET	11048	50084	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:59.489250898 CET	50084	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:59.608845949 CET	11048	50084	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:59.608927965 CET	50084	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:59.728600979 CET	11048	50084	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:59.728801012 CET	50084	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:10:59.848556042 CET	11048	50084	18.192.93.86	192.168.2.4
Dec 28, 2024 21:10:59.849699974 CET	50084	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:11:00.198230982 CET	11048	50084	18.192.93.86	192.168.2.4
Dec 28, 2024 21:11:00.198395014 CET	50084	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:11:00.319520950 CET	11048	50084	18.192.93.86	192.168.2.4
Dec 28, 2024 21:11:00.322705030 CET	50084	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:11:00.414792061 CET	11048	50084	18.192.93.86	192.168.2.4
Dec 28, 2024 21:11:00.417701960 CET	50084	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:11:00.442383051 CET	11048	50084	18.192.93.86	192.168.2.4
Dec 28, 2024 21:11:00.448040962 CET	50084	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:11:00.449065924 CET	50085	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:11:00.537220001 CET	11048	50084	18.192.93.86	192.168.2.4
Dec 28, 2024 21:11:00.567555904 CET	11048	50084	18.192.93.86	192.168.2.4
Dec 28, 2024 21:11:00.568499088 CET	11048	50085	18.192.93.86	192.168.2.4
Dec 28, 2024 21:11:00.568713903 CET	50085	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:11:00.627393007 CET	50085	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:11:00.747008085 CET	11048	50085	18.192.93.86	192.168.2.4
Dec 28, 2024 21:11:00.749558926 CET	50085	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:11:00.869307995 CET	11048	50085	18.192.93.86	192.168.2.4
Dec 28, 2024 21:11:00.869658947 CET	50085	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:11:00.989464045 CET	11048	50085	18.192.93.86	192.168.2.4
Dec 28, 2024 21:11:00.989854097 CET	50085	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:11:01.109631062 CET	11048	50085	18.192.93.86	192.168.2.4
Dec 28, 2024 21:11:01.261651993 CET	50085	11048	192.168.2.4	18.192.93.86
Dec 28, 2024 21:11:01.381477118 CET	11048	50085	18.192.93.86	192.168.2.4
Dec 28, 2024 21:11:01.952006102 CET	11048	50085	18.192.93.86	192.168.2.4
Dec 28, 2024 21:11:01.952671051 CET	50085	11048	192.168.2.4	18.192.93.86

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 21:07:09.230026960 CET	59325	53	192.168.2.4	1.1.1.1
Dec 28, 2024 21:07:09.446091890 CET	53	59325	1.1.1.1	192.168.2.4
Dec 28, 2024 21:08:10.619122028 CET	63854	53	192.168.2.4	1.1.1.1
Dec 28, 2024 21:08:10.833631992 CET	53	63854	1.1.1.1	192.168.2.4
Dec 28, 2024 21:09:11.543486118 CET	53980	53	192.168.2.4	1.1.1.1
Dec 28, 2024 21:09:11.754590988 CET	53	53980	1.1.1.1	192.168.2.4
Dec 28, 2024 21:10:13.384993076 CET	51248	53	192.168.2.4	1.1.1.1
Dec 28, 2024 21:10:13.879786015 CET	53	51248	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 28, 2024 21:07:09.230026960 CET	192.168.2.4	1.1.1.1	0x7a94	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Dec 28, 2024 21:08:10.619122028 CET	192.168.2.4	1.1.1.1	0x472d	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Dec 28, 2024 21:09:11.543486118 CET	192.168.2.4	1.1.1.1	0xda41	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Dec 28, 2024 21:10:13.384993076 CET	192.168.2.4	1.1.1.1	0x8dd	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 28, 2024 21:07:09.446091890 CET	1.1.1.1	192.168.2.4	0x7a94	No error (0)	2.tcp.eu.ngrok.io	3.126.37.18	A (IP address)	IN (0x0001)	false
Dec 28, 2024 21:08:10.833631992 CET	1.1.1.1	192.168.2.4	0x472d	No error (0)	2.tcp.eu.ngrok.io	18.156.13.209	A (IP address)	IN (0x0001)	false
Dec 28, 2024 21:09:11.754590988 CET	1.1.1.1	192.168.2.4	0xda41	No error (0)	2.tcp.eu.ngrok.io	18.197.239.5	A (IP address)	IN (0x0001)	false
Dec 28, 2024 21:10:13.879786015 CET	1.1.1.1	192.168.2.4	0x8dd	No error (0)	2.tcp.eu.ngrok.io	18.192.93.86	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	15:06:52
Start date:	28/12/2024
Path:	C:\Users\user\Desktop\oiA5KmV0f0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\oiA5KmV0f0.exe"
Imagebase:	0x370000
File size:	44'032 bytes
MD5 hash:	1917739297383BB37D4F159E8540B70B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000002.1717580034.000000000261E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000002.1717580034.000000000261E000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Njrat, Description: detect njRAT in memory, Source: 00000000.00000002.1717580034.000000000261E000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000002.1717580034.0000000002611000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000000.1649870964.0000000000372000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000000.1649870964.0000000000372000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: Njrat, Description: detect njRAT in memory, Source: 00000000.00000000.1649870964.0000000000372000.00000002.00000001.01000000.00000003.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:06:59
Start date:	28/12/2024
Path:	C:\Users\user\AppData\Roaming\Dllhost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Dllhost.exe"
Imagebase:	0xa30000
File size:	44'032 bytes
MD5 hash:	1917739297383BB37D4F159E8540B70B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Dllhost.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Dllhost.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\Dllhost.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Dllhost.exe, Author: JPCERT/CC Incident Response Group
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 86%, ReversingLabs Detection: 83%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	15:07:05
Start date:	28/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\user\AppData\Local\Temp/Server.exe
Imagebase:	0xc20000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:07:05
Start date:	28/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:07:06
Start date:	28/12/2024
Path:	C:\Users\user\AppData\Local\Temp\Server.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp/Server.exe
Imagebase:	0x810000
File size:	44'032 bytes
MD5 hash:	1917739297383BB37D4F159E8540B70B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Local\Temp\Server.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\Server.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Local\Temp\Server.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Local\Temp\Server.exe, Author: JPCERT/CC Incident Response Group
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 86%, ReversingLabs Detection: 83%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:07:17
Start date:	28/12/2024
Path:	C:\Users\user\AppData\Roaming\Dllhost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Dllhost.exe" ..
Imagebase:	0x9c0000
File size:	44'032 bytes
MD5 hash:	1917739297383BB37D4F159E8540B70B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:07:26
Start date:	28/12/2024
Path:	C:\Users\user\AppData\Roaming\Dllhost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Dllhost.exe" ..
Imagebase:	0x600000
File size:	44'032 bytes
MD5 hash:	1917739297383BB37D4F159E8540B70B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:07:34
Start date:	28/12/2024
Path:	C:\Users\user\AppData\Roaming\Dllhost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Dllhost.exe" ..
Imagebase:	0x7ff70f330000
File size:	44'032 bytes
MD5 hash:	1917739297383BB37D4F159E8540B70B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	15:07:43
Start date:	28/12/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe"
Imagebase:	0xe20000
File size:	44'032 bytes
MD5 hash:	1917739297383BB37D4F159E8540B70B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, Author: JPCERT/CC Incident Response Group
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 86%, ReversingLabs Detection: 83%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	15:08:01
Start date:	28/12/2024
Path:	C:\Users\user\AppData\Local\Temp\Server.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp/Server.exe
Imagebase:	0x690000
File size:	44'032 bytes
MD5 hash:	1917739297383BB37D4F159E8540B70B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	15:09:00
Start date:	28/12/2024
Path:	C:\Users\user\AppData\Local\Temp\Server.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp/Server.exe
Imagebase:	0x860000
File size:	44'032 bytes
MD5 hash:	1917739297383BB37D4F159E8540B70B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	15:10:00
Start date:	28/12/2024
Path:	C:\Users\user\AppData\Local\Temp\Server.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp/Server.exe
Imagebase:	0x7ff7699e0000
File size:	44'032 bytes
MD5 hash:	1917739297383BB37D4F159E8540B70B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	15:11:00
Start date:	28/12/2024
Path:	C:\Users\user\AppData\Local\Temp\Server.exe
Wow64 process (32bit):
Commandline:	C:\Users\user\AppData\Local\Temp/Server.exe
Imagebase:
File size:	44'032 bytes
MD5 hash:	1917739297383BB37D4F159E8540B70B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Function 00CB4B81 Relevance: 1.8, Strings: 1, Instructions: 505COMMON

Download Yara Rule

Strings

dbq, xrefs: 00CB4E65

Memory Dump Source

Source File: 00000000.00000002.1717309655.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_oiA5KmV0f0.jbxd

Similarity

API ID:
String ID: dbq
API String ID: 0-1887291361
Opcode ID: ea015bc027775587766519b8f8915212aa895d55ba3f43a1cc4d6de0a6807964
Instruction ID: 84cb9cc3470830d3ef0219bfb6ffe81df6feae682cf306424097496eca86b6ce
Opcode Fuzzy Hash: ea015bc027775587766519b8f8915212aa895d55ba3f43a1cc4d6de0a6807964
Instruction Fuzzy Hash: 2F326E74A00214CFDB25EF34D854BADBBB2FB48305F1445AAE90AA73A8DB719D81DF50

Function 00CB1700 Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

Te^q, xrefs: 00CB1842

Memory Dump Source

Source File: 00000000.00000002.1717309655.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_oiA5KmV0f0.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 6a00828b628afa123ea3a43fb9dfabb409e70c22884b91a41ca147c9358bc319
Instruction ID: f285d5c96d54dec3778f0f00ae6ab613284234bbfa5bb9123f0bbdcf1705c793
Opcode Fuzzy Hash: 6a00828b628afa123ea3a43fb9dfabb409e70c22884b91a41ca147c9358bc319
Instruction Fuzzy Hash: F251F1745402458FCB06FF69FD90A59BBB2FB44704B18AA66D0059B33EDB70A949CF90

Function 00CB1710 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

Te^q, xrefs: 00CB1842

Memory Dump Source

Source File: 00000000.00000002.1717309655.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_oiA5KmV0f0.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: f3bb1419e8dd04a49cd3b4d7e1e946149351f12eafa41c352a9ec0b69c7eafcd
Instruction ID: 42a7b633bd0272178eafe707985f7843dabca89c902e6358083924270d901a6d
Opcode Fuzzy Hash: f3bb1419e8dd04a49cd3b4d7e1e946149351f12eafa41c352a9ec0b69c7eafcd
Instruction Fuzzy Hash: 0E51E274540245CFCB05FF69FD90A59BBB2FB84704B18AA66D0059B33DEB70A949CF90

Function 00CB0DCF Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

4'^q, xrefs: 00CB0DA8

Memory Dump Source

Source File: 00000000.00000002.1717309655.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_oiA5KmV0f0.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 156cbda768a0ee1c07901b4fc2343492c2565f0a46ebe829564648512aad0a9e
Instruction ID: ed6bcd2fea4b228b92aa270b38183cf473c190d884070146267fe8bc9a7d4b67
Opcode Fuzzy Hash: 156cbda768a0ee1c07901b4fc2343492c2565f0a46ebe829564648512aad0a9e
Instruction Fuzzy Hash: 06318F706003459FC716EF38D8106AEBBA2EF81304B144A6AD05A9B3A9DF71ED49CBC1

Function 00CB914D Relevance: .7, Instructions: 719COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1717309655.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_oiA5KmV0f0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2963d3d319ee81fc3bb69217e3ffe6d410326dfb6a270ba803446611f63019b
Instruction ID: 1915798b2327be8751ddabb953d6d9e392fbdc01a36e51139af70f11d35c3a84
Opcode Fuzzy Hash: a2963d3d319ee81fc3bb69217e3ffe6d410326dfb6a270ba803446611f63019b
Instruction Fuzzy Hash: DAF14C78A00214CFDB25EF64D994BAD77B2FF48704F2041AAD80AA73A9DB319D81CF51

Function 00CB9468 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1717309655.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_oiA5KmV0f0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c35ad6717944968a12bb0d8fcdf07f4db9e9bf06efabcca7b22b6c92d42a4da0
Instruction ID: fa672b15c7333007059e949bbea219041c638cf3bc95c34aace67918090aedaf
Opcode Fuzzy Hash: c35ad6717944968a12bb0d8fcdf07f4db9e9bf06efabcca7b22b6c92d42a4da0
Instruction Fuzzy Hash: 66F13D78A00214CFDB25EF64D994BAD77B2FF48704F2041AAD90AA73A9DB319D81CF51

Function 00CBA2EC Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1717309655.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_oiA5KmV0f0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cb7c9319be4cdd86c910d19a0075c77d1030dcbf0491bd3285dc4c02aa6ea8f
Instruction ID: 0867632048215595e91089c15314889fd2b47b0b5993e5449cc5aa7e059269e6
Opcode Fuzzy Hash: 8cb7c9319be4cdd86c910d19a0075c77d1030dcbf0491bd3285dc4c02aa6ea8f
Instruction Fuzzy Hash: 4AE08672A153509FC7161B74602C1E47BE1DA6B22174500A6D845C7352FDAA8C878F92

Function 00CB49E1 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1717309655.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_oiA5KmV0f0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7603ea7abf9bc28f14b6b8d80c35cdddabe3b94fd975cdee8ce301a6cbeaec60
Instruction ID: 647e67a920c82d4ee9cdc0e2aedf5ffc2832854f2c67dad01f28b2472264d339
Opcode Fuzzy Hash: 7603ea7abf9bc28f14b6b8d80c35cdddabe3b94fd975cdee8ce301a6cbeaec60
Instruction Fuzzy Hash: E241A230B002159FDB15BB78D82576F3BAAEB84700F144469D00AD73A9DE75DD468BD1

Function 00CB49F0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1717309655.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_oiA5KmV0f0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 799b5be68f45a6a93b7e8609759bb06be1f5532405fedd9dfee2dba8befc3c84
Instruction ID: c368f256d0ebb60a85593adb62d8bef25e2eccfb4b03f0b3f696ed744a8b79c5
Opcode Fuzzy Hash: 799b5be68f45a6a93b7e8609759bb06be1f5532405fedd9dfee2dba8befc3c84
Instruction Fuzzy Hash: A8319D30B002159FDB19BB78E82576F3BAAEB84700F144469E10AD73A8DE75DD498BD1

Function 00CB0890 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1717309655.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_oiA5KmV0f0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecd4fb352898f9ac231cd0fe8ea49a410f0d4f8ed8b8292712a7b42300cbbc36
Instruction ID: 74c1f1db5aa2ad489b66e34708a55d18f5912f7edb30c006632af8aded56a422
Opcode Fuzzy Hash: ecd4fb352898f9ac231cd0fe8ea49a410f0d4f8ed8b8292712a7b42300cbbc36
Instruction Fuzzy Hash: D9319CB19003089FDB14DFA9C8457DFBFF5EF48320F208469E519A7291D776A940CB90

Function 00CB48C0 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1717309655.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_oiA5KmV0f0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e0439a39946bcd055cdbbb78acfa7f6a4a31b80bbd4ef0becad49e76325d31a
Instruction ID: c6faf09ff1454ec6c4f65b2edaf585f1ecae922da995b3f3869d9ae54e6c52b3
Opcode Fuzzy Hash: 3e0439a39946bcd055cdbbb78acfa7f6a4a31b80bbd4ef0becad49e76325d31a
Instruction Fuzzy Hash: 083181759042899FCB06EB64E8616ADBF71EB91305F1005AAD001E73EAEA309E4DCB61

Function 00CB0994 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1717309655.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_oiA5KmV0f0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9128d649de7bf463b81a59e45568709ee918ff3b46c74dce0ffee1a92b3d89bb
Instruction ID: 5d82a45ff181ab9c98e690b54d11c28afd039f8d8759c277bbb9b2d989bf5cbe
Opcode Fuzzy Hash: 9128d649de7bf463b81a59e45568709ee918ff3b46c74dce0ffee1a92b3d89bb
Instruction Fuzzy Hash: F6310FB0D01248DFDB14CFA9D584BCEBFF5AF49310F24806AE409BB2A4CB75A945CB90

Function 00CB09A0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1717309655.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_oiA5KmV0f0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d53f42480717e58ed9d7edaf3237e308066f23a8f206eb1b6586719b353669fb
Instruction ID: de1aaf030ba933aa5397d517548038191d49607dc56d0b40a35fed3c3ba9bc3f
Opcode Fuzzy Hash: d53f42480717e58ed9d7edaf3237e308066f23a8f206eb1b6586719b353669fb
Instruction Fuzzy Hash: B131DEB0D01248DFDB14CFA9D584BDEBBF5AF48310F24802AE409BB264CB75A945CB94

Function 00CB48E8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1717309655.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_oiA5KmV0f0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e8ec47f1ed6e61af5973fd76d19ff4d3ae88b45fffc8accca18e9b40dc0fc1d
Instruction ID: a122c15fc5969be9151ba9e281057d720b6093a52a46ba8ad8ea8ce1504d0acf
Opcode Fuzzy Hash: 6e8ec47f1ed6e61af5973fd76d19ff4d3ae88b45fffc8accca18e9b40dc0fc1d
Instruction Fuzzy Hash: 6C11513494020E9FCF01EBA9E8556ADBB71EFC4301F104569D506A73A8DF70AA8CCB95

Function 00CB0DE0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1717309655.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_oiA5KmV0f0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48cc0c355902f5f27416a60334cd42e082da1574dfa71d48e936185477cb2df6
Instruction ID: ec92da9b546fc2f7546b67294d75e5bb6087d1a4209622d7e8ed74ff726bb656
Opcode Fuzzy Hash: 48cc0c355902f5f27416a60334cd42e082da1574dfa71d48e936185477cb2df6
Instruction Fuzzy Hash: 281170712007405FC715EB29D4056AABBE6AB813547144D2DD01A9F7A8DFB1ED498FC1

Function 00CB08F8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1717309655.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_oiA5KmV0f0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b20a021e4ea2db9286e83684b4010c82a1843c18ae0dbfd3e28e7ca8ba3c565a
Instruction ID: 9a1b46a5a183c98c283af9317f1b203d26d67ef26e4d6b6fd1952680efd3d252
Opcode Fuzzy Hash: b20a021e4ea2db9286e83684b4010c82a1843c18ae0dbfd3e28e7ca8ba3c565a
Instruction Fuzzy Hash: 011122B5C002598FCB20CFAAC484BDEBFF4EB48324F20845AD45AA7251C375A944CFA1

Function 00CBA480 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1717309655.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_oiA5KmV0f0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e20574b15b8c3164c32f78f1c060d2374a6f5097b8d5a3d1fcb6899c21d0e3bc
Instruction ID: a41c2b0212d03aea6d3a4dd1fc96bfd6254549a6b24dd76353b0a4df26a7e343
Opcode Fuzzy Hash: e20574b15b8c3164c32f78f1c060d2374a6f5097b8d5a3d1fcb6899c21d0e3bc
Instruction Fuzzy Hash: 060122727012509BE7022B7CB4282A87F52EBD2345B8100AAD885CB395EF25CD868B82

Function 00CB0900 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1717309655.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_oiA5KmV0f0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5fa3743637b5219c1d6aa92ed67f01db7f3b1b7845a37c514208e053835f8c1
Instruction ID: f0e5859251a46c259a1d65f9eefc3553434805d74a4b6911420e87ef7d8636e1
Opcode Fuzzy Hash: f5fa3743637b5219c1d6aa92ed67f01db7f3b1b7845a37c514208e053835f8c1
Instruction Fuzzy Hash: 6B1100B59003598FDB20DFAAC444BDEBBF4EB48324F208419D459A7251C775A984CFA5

Function 00CB8E08 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1717309655.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_oiA5KmV0f0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e020b85f5c751ef34b523b2bbdbb0072387cb9b630d9a12fb87c2f8003756417
Instruction ID: 3e76323003b885b270c1aa47657c942efc3e0206092ba999de43c9b226586595
Opcode Fuzzy Hash: e020b85f5c751ef34b523b2bbdbb0072387cb9b630d9a12fb87c2f8003756417
Instruction Fuzzy Hash: C2017834708251CFDB01EB3CD61461ABBE1AF8A310F0148AEE0D98B3A4DA34ED44CB86

Function 00CB0880 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1717309655.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_oiA5KmV0f0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13d747ece665b1637216ab9da8aa35a30c94e19d6379b3e9e02379354b4fdf17
Instruction ID: 188b95e12239cfa4387fb0a7d2c11a388a748855a205c805b657c558322cddd6
Opcode Fuzzy Hash: 13d747ece665b1637216ab9da8aa35a30c94e19d6379b3e9e02379354b4fdf17
Instruction Fuzzy Hash: B9F0C271A44304AFEB099BB1CC062DF3F66EF96320F2485AAE119DF2E1D93295019780

Function 00CB0EA0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1717309655.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_oiA5KmV0f0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aab57568b1d6b1822a82e78b79a5744a0568cae43066883c2efba1ad838d5c34
Instruction ID: 3fc25e4e900eda7a4e65a15152093a212d0daff2a58eab9db94790b745e8b562
Opcode Fuzzy Hash: aab57568b1d6b1822a82e78b79a5744a0568cae43066883c2efba1ad838d5c34
Instruction Fuzzy Hash: 90F055713083008FC7155B79A8101AA7BA2EA813453240EBBD04ACF36CDF64C847C3C1

Function 00CB0839 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1717309655.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_oiA5KmV0f0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa417a6aaaf8963b249593c7ac9f6cc13efeb0d64d47c987a6127c4c066bbada
Instruction ID: 1489f5803b74dbc7efe743b59f163ed0ab5f8b2386cfcbe47f5300a52a29f562
Opcode Fuzzy Hash: fa417a6aaaf8963b249593c7ac9f6cc13efeb0d64d47c987a6127c4c066bbada
Instruction Fuzzy Hash: 61E046300182C48FC727AB28ED217057FA4AB12205F0915D3C0848F37BC6A5491887E2

Function 00CB9FFF Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1717309655.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_oiA5KmV0f0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59fea02789dfaa97762edaea7c60b4f1ed41548bd284cbd7bbbdb72831fc5062
Instruction ID: 573fe2153969638d5af3d53015c3d73a1b20834f54eb4379e4d5f68612e01684
Opcode Fuzzy Hash: 59fea02789dfaa97762edaea7c60b4f1ed41548bd284cbd7bbbdb72831fc5062
Instruction Fuzzy Hash: 1CE0865174D7C55BD7167378642812D3F90995B118B840DCED4C7CB1D2DD099403839B

Function 00CBA458 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1717309655.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_oiA5KmV0f0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aae79fe85a5c13fb832aa671cd53cdbcb3e8b19325a71555612656e023a5a315
Instruction ID: ba883da8b95d6ad5e4e13dbb6bc57a9922d256f70b16ebdd4158ca64c863289d
Opcode Fuzzy Hash: aae79fe85a5c13fb832aa671cd53cdbcb3e8b19325a71555612656e023a5a315
Instruction Fuzzy Hash: 59D01231701314DBC7152775A42C29977D9EB49522340047AE806C3300DE7EDC8187D0

Function 00CB0848 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1717309655.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_oiA5KmV0f0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dc41af511b67b45c0de1bacd097dc0223670e31e77f9871378db14fda2bf5e3
Instruction ID: ae0c7cf391bf87bb64e5447408cb3ec1b0f058325e842c90107ba985104002cb
Opcode Fuzzy Hash: 5dc41af511b67b45c0de1bacd097dc0223670e31e77f9871378db14fda2bf5e3
Instruction Fuzzy Hash: 23D0A9300002898ECB26EB29FC06709BF98F700308F082162D0084B33ECBF2A4288BC0

Analysis Process: Dllhost.exePID: 4464, Parent PID: 6552COMMON

Execution Graph

Execution Coverage:	12.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	7.9%
Total number of Nodes:	165
Total number of Limit Nodes:	10

Executed Functions

Function 054B0040 Relevance: 8.4, Strings: 6, Instructions: 893COMMON

Download Yara Rule

Strings

,bq, xrefs: 054B0928
,bq, xrefs: 054B091A
(o^q, xrefs: 054B08B0
(o^q, xrefs: 054B056A
(o^q, xrefs: 054B08A2
Hbq, xrefs: 054B0436

Memory Dump Source

Source File: 00000001.00000002.4135330208.00000000054B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_54b0000_Dllhost.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$,bq$,bq$Hbq
API String ID: 0-56095411
Opcode ID: 55142c9a59e0de645210c7ebba281c7dc4d54a049873b8e94658c5fbd9e21295
Instruction ID: 2d99157b04dbf392bab7d00107d9ad5f720623b2a83b34d5a60a8f36f53c1f68
Opcode Fuzzy Hash: 55142c9a59e0de645210c7ebba281c7dc4d54a049873b8e94658c5fbd9e21295
Instruction Fuzzy Hash: 88724F70A002199FDB14DFA9C898AEFBBB6FF88305F14855AE419AB351DB70DD41CB60

Function 0530AA15 Relevance: 1.7, APIs: 1, Instructions: 217
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,?,00000000,00000000,?,?,?,00000000,00000000,?), ref: 0530AC11

Memory Dump Source

Source File: 00000001.00000002.4134777201.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5300000_Dllhost.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: b86917c3ce30e7d7101035397c6209fa6f0530f0b69c109b2c2931b874462cf8
Instruction ID: cb550a4d99a6dde21c78f10aec6ef757ca37265f92ef696eddf32b64aa21ff1b
Opcode Fuzzy Hash: b86917c3ce30e7d7101035397c6209fa6f0530f0b69c109b2c2931b874462cf8
Instruction Fuzzy Hash: 9C9105B1D00319DFDB14CFA9D8947DEBBB2BF88310F29812AE405A7290D7709945CF81

Function 0530AA20 Relevance: 1.7, APIs: 1, Instructions: 215
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,?,00000000,00000000,?,?,?,00000000,00000000,?), ref: 0530AC11

Memory Dump Source

Source File: 00000001.00000002.4134777201.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5300000_Dllhost.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 23dfc38badd30120f534f311c4e4dd3ebd11d23524baf9b74cecc7133e498c51
Instruction ID: 5546cdc7ecae5b5272357a6ac9e907087acd052bab7aabd3012597d9b49271bb
Opcode Fuzzy Hash: 23dfc38badd30120f534f311c4e4dd3ebd11d23524baf9b74cecc7133e498c51
Instruction Fuzzy Hash: 6091F471D00719DFDB14CFA9D8947DEBBB2BF88310F29812AE415A7290D7B0A985CF91

Function 054B2B30 Relevance: 1.6, APIs: 1, Instructions: 54nativeCOMMON

Download Yara Rule

APIs

NtSetInformationProcess.NTDLL(?,?,?,?), ref: 054B2BAB

Memory Dump Source

Source File: 00000001.00000002.4135330208.00000000054B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_54b0000_Dllhost.jbxd

Similarity

API ID: InformationProcess
String ID:
API String ID: 1801817001-0
Opcode ID: ae989b6f9825a810602306975f02c96953fe8e4c696ae8e734735180b966b708
Instruction ID: 34566aad14c55051bc8885b5827fd279bf65608aadbc2b4179d399c44644c302
Opcode Fuzzy Hash: ae989b6f9825a810602306975f02c96953fe8e4c696ae8e734735180b966b708
Instruction Fuzzy Hash: E511F6B59042499FCB10DF9AD484BDEFBF4FB48320F10842AE869A7350C775A945CFA5

Function 054B2B38 Relevance: 1.6, APIs: 1, Instructions: 51nativeCOMMON

Download Yara Rule

APIs

NtSetInformationProcess.NTDLL(?,?,?,?), ref: 054B2BAB

Memory Dump Source

Source File: 00000001.00000002.4135330208.00000000054B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_54b0000_Dllhost.jbxd

Similarity

API ID: InformationProcess
String ID:
API String ID: 1801817001-0
Opcode ID: e644b444d9076511dcae9ea26ddf2214f5418a75f5a285c3430da02a15a87f26
Instruction ID: 8c5ea99e5b4902044a4842e3d5b2463117f4b4f86c03a9eb85f091deb6385ce5
Opcode Fuzzy Hash: e644b444d9076511dcae9ea26ddf2214f5418a75f5a285c3430da02a15a87f26
Instruction Fuzzy Hash: 5B11F0B59042499FCB10DF9AD484BDEFBF4FB48320F10842AE869A7210C7B5A944CFA5

Function 055F8608 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

\VTm, xrefs: 055F88BF

Memory Dump Source

Source File: 00000001.00000002.4135555477.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55f0000_Dllhost.jbxd

Similarity

API ID:
String ID: \VTm
API String ID: 0-628799665
Opcode ID: 14358ffe9bce57217ba538e90f2978cfc9124d811019f3e11ec9419c9cfdbbdb
Instruction ID: 07369cb74ef9d37a05a59c52672eb340da8a762cce0c3d377b3ccc5dae7990d2
Opcode Fuzzy Hash: 14358ffe9bce57217ba538e90f2978cfc9124d811019f3e11ec9419c9cfdbbdb
Instruction Fuzzy Hash: F5B16E70E002099FDF14CFA9D9857EEBBF2BF88314F148529D919E7294EB749845CB81

Function 054B2BD8 Relevance: 1.5, APIs: 1, Instructions: 31nativeCOMMON

Download Yara Rule

APIs

NtSetInformationProcess.NTDLL(?,?,?,?), ref: 054B2BAB

Memory Dump Source

Source File: 00000001.00000002.4135330208.00000000054B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_54b0000_Dllhost.jbxd

Similarity

API ID: InformationProcess
String ID:
API String ID: 1801817001-0
Opcode ID: b62a8b7f4e3a572a12e377f10bfbb53170e4250060df6c976efb0d85ab485d97
Instruction ID: acc05ad05f59dc1bb4d52d5c7bd4c834f5290222d40f811dcc6610632f689ca2
Opcode Fuzzy Hash: b62a8b7f4e3a572a12e377f10bfbb53170e4250060df6c976efb0d85ab485d97
Instruction Fuzzy Hash: 81F090B6C0C3548EEB119F99D8483DABFF0EB69315F04808BC0A9A7161C7F89149CB61

Function 055F28A0 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135555477.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55f0000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bddc4ae723484b4cf9c792910a0dee7ac0e593b40f6efe16513380414362da1
Instruction ID: a1244a51791dda19f18f1b36bb4a2247365d40a5db74764fb3912f2c90940fad
Opcode Fuzzy Hash: 8bddc4ae723484b4cf9c792910a0dee7ac0e593b40f6efe16513380414362da1
Instruction Fuzzy Hash: B9F14E74A00209CFDB14DFA9C948BADBBF2FF88314F148559E509AB265DB70E945CF90

Function 055F8ED8 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135555477.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55f0000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba650ab973e916d80c2a6d0661ad9da2bcca15493eb8f80d544d7d5dbdbf7ea5
Instruction ID: 5775cabc6686d7ae9bb94c38dd4e5ae5c4aeda010234ecdf512ed0efcdf4de1b
Opcode Fuzzy Hash: ba650ab973e916d80c2a6d0661ad9da2bcca15493eb8f80d544d7d5dbdbf7ea5
Instruction Fuzzy Hash: 9FB16170E00609DFDB14CFA9C885BEDBBF2BF48314F148529E919E7294EB759885CB81

Function 054B3DE9 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 054B3E76
GetCurrentThread.KERNEL32 ref: 054B3EB3
GetCurrentProcess.KERNEL32 ref: 054B3EF0
GetCurrentThreadId.KERNEL32 ref: 054B3F49

Memory Dump Source

Source File: 00000001.00000002.4135330208.00000000054B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_54b0000_Dllhost.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: c869455079f893dfbb1de762bb5761cb1f41ad5296c812aab225f2c96dc78038
Instruction ID: e28b9295411e929e34bf7d989bd06b406df27d58fdfb895d82faed7fa624b9e5
Opcode Fuzzy Hash: c869455079f893dfbb1de762bb5761cb1f41ad5296c812aab225f2c96dc78038
Instruction Fuzzy Hash: BC5158B49002098FDB14DFAAD548BEEBBF1FF48314F20845AE409A7360DB75A984CF65

Function 054B3DF8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 054B3E76
GetCurrentThread.KERNEL32 ref: 054B3EB3
GetCurrentProcess.KERNEL32 ref: 054B3EF0
GetCurrentThreadId.KERNEL32 ref: 054B3F49

Memory Dump Source

Source File: 00000001.00000002.4135330208.00000000054B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_54b0000_Dllhost.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: ab3e201c6be4d58e762dcc61efba2df9f7fd8f9dba4a411a3350c4b03367ca1f
Instruction ID: 790e970efcb1daf5d8207fae62e10f8437cc78df21aadc1a4071be6f4cfadd22
Opcode Fuzzy Hash: ab3e201c6be4d58e762dcc61efba2df9f7fd8f9dba4a411a3350c4b03367ca1f
Instruction Fuzzy Hash: 335156B49002098FDB14DFAAD548BEEBBF1FF48314F20845AE409A7360DB75A984CF65

Function 055F5070 Relevance: 1.9, APIs: 1, Instructions: 379
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 055F50A5

Memory Dump Source

Source File: 00000001.00000002.4135555477.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55f0000_Dllhost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: f52c72c770f86528a30b87bc0c5aaf310e082db9ed0b5196153d537f15b9e6ad
Instruction ID: 03489581694863db1230a65cec4451253c328b174b7fa99618afa7f4503c5d1d
Opcode Fuzzy Hash: f52c72c770f86528a30b87bc0c5aaf310e082db9ed0b5196153d537f15b9e6ad
Instruction Fuzzy Hash: 69E11938E01315DFDB05EF75D458A6EBBB2BB84704F104629E50E9B3A8EB359C42CB81

Function 055F505F Relevance: 1.8, APIs: 1, Instructions: 297
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 055F50A5

Memory Dump Source

Source File: 00000001.00000002.4135555477.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55f0000_Dllhost.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 5725074a414591eb161fd4878b792e8b0c3cea5ebd557ca8ca1a641b13016756
Instruction ID: 02025aede5b8c7e66962e8d53cd1cfd561a33e37c359072369e86247c7134630
Opcode Fuzzy Hash: 5725074a414591eb161fd4878b792e8b0c3cea5ebd557ca8ca1a641b13016756
Instruction Fuzzy Hash: 0CC12B38E01315DFDB16EF65D494A6E7BB3BB84704F204668D50E9B398EB31AC42CB81

Function 054BB798 Relevance: 1.7, APIs: 1, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 054BB9FE

Memory Dump Source

Source File: 00000001.00000002.4135330208.00000000054B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_54b0000_Dllhost.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4de6639dc15a01c28c9548ca3711cec0d6f510c21e9587c915435c0bb5a6c692
Instruction ID: bf6a7097374b9e778a643d88f602b0e8f33f43936be2533b070d90c094895a2a
Opcode Fuzzy Hash: 4de6639dc15a01c28c9548ca3711cec0d6f510c21e9587c915435c0bb5a6c692
Instruction Fuzzy Hash: E6811770A00B058FE764DF6AD4457AABBF1FF48204F048A6ED48AD7B50DB75E845CBA0

Function 055F5A0D Relevance: 1.6, APIs: 1, Instructions: 130COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNELBASE(?,?,?,?,?,?,?,?), ref: 055F5B14

Memory Dump Source

Source File: 00000001.00000002.4135555477.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55f0000_Dllhost.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: f9ea5b46d3a03189c9e49255798652af69cb4e2245e02667d2013b5a3b1510fa
Instruction ID: 6ad0f182d57909c3897d51e87f78b39e9b0685b561b48f27008f2e3b57a1517f
Opcode Fuzzy Hash: f9ea5b46d3a03189c9e49255798652af69cb4e2245e02667d2013b5a3b1510fa
Instruction Fuzzy Hash: C451BCB0E002489FDB14DFA9C584BDDBBF5FF49304F208129E449AB268DB75A945CF94

Function 055F5A18 Relevance: 1.6, APIs: 1, Instructions: 128COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNELBASE(?,?,?,?,?,?,?,?), ref: 055F5B14

Memory Dump Source

Source File: 00000001.00000002.4135555477.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55f0000_Dllhost.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: ebde2273a5fafa65613704c9298d09b34df6d388a49e084213d156e2177ddb71
Instruction ID: 51fe351028f11ad2f7cca871dcc57bd400996daf15cdbe74b99994ffdfcc60b5
Opcode Fuzzy Hash: ebde2273a5fafa65613704c9298d09b34df6d388a49e084213d156e2177ddb71
Instruction Fuzzy Hash: 2B51CDB0E002489FDB14CFA9C584BDDBBF5BF49304F208129E409AB268DB75A945CF94

Function 054BD984 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 054BDAA2

Memory Dump Source

Source File: 00000001.00000002.4135330208.00000000054B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_54b0000_Dllhost.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 8496071914976d8833a8d0bdf5aa04590d16fe6f74b1caf70e1e796be20990f3
Instruction ID: 73783ea842360cb8bcc51f0230d83fc9c15d1555078f1fd95691a1dd47eeb9cf
Opcode Fuzzy Hash: 8496071914976d8833a8d0bdf5aa04590d16fe6f74b1caf70e1e796be20990f3
Instruction Fuzzy Hash: D151D1B1D043499FDF14CFA9C884ADEBBB5FF48314F24856AE819AB210D7B19885CF90

Function 054BD990 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 054BDAA2

Memory Dump Source

Source File: 00000001.00000002.4135330208.00000000054B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_54b0000_Dllhost.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: cf7b302fe86051ac03ab3a4a440b31c7963483abafff36ae8d7350a5ac6ae010
Instruction ID: 3f6859b6c5835824fd3aeb5a4dbd41f4fcc0809a1d5f9dcdde26c8902eabf424
Opcode Fuzzy Hash: cf7b302fe86051ac03ab3a4a440b31c7963483abafff36ae8d7350a5ac6ae010
Instruction Fuzzy Hash: 4F41C0B1D043499FDF14CFA9C984ADEBBB5FF48310F24856AE819AB210D7B19845CF90

Function 055F0040 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 055F0101

Memory Dump Source

Source File: 00000001.00000002.4135555477.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55f0000_Dllhost.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: d110b64e79273ddf05ad767273b58b0ba35cf4d54dc03bd44abf24e22402185e
Instruction ID: b544ea08754d87a635f4ec6c1f96905bf7b8c976e1f118024df3805b8f419d0c
Opcode Fuzzy Hash: d110b64e79273ddf05ad767273b58b0ba35cf4d54dc03bd44abf24e22402185e
Instruction Fuzzy Hash: 55411AB5A00309CFDB14CF59C848EAABBF5FB88314F28C459D519AB361D775A841CFA0

Function 0530E3A0 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(00000000), ref: 0530E448

Memory Dump Source

Source File: 00000001.00000002.4134777201.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5300000_Dllhost.jbxd

Similarity

API ID: IdleInputWait
String ID:
API String ID: 2200289081-0
Opcode ID: 9564fe78c5b78fba28ad762b7c0791c331b64afe6dfe9300a71f3cb55e980e70
Instruction ID: 31c2764eaf86b3b8d7f2c2c8d23fc3af463959874edd3c0e46bea213d07d603e
Opcode Fuzzy Hash: 9564fe78c5b78fba28ad762b7c0791c331b64afe6dfe9300a71f3cb55e980e70
Instruction Fuzzy Hash: CC3168B1D042589FCB15CFA9C995BCEBFF4AF49210F28845AD448AB391DA389805CF61

Function 054B4038 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 054B40C7

Memory Dump Source

Source File: 00000001.00000002.4135330208.00000000054B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_54b0000_Dllhost.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7a2625bca4e6dd35d310c8756565800c5489447e8aa02582f3906d89fd0db3f6
Instruction ID: 7c8aa2b7718becc3e25c041ae50521f465623b5143d9ef037387d34922d81631
Opcode Fuzzy Hash: 7a2625bca4e6dd35d310c8756565800c5489447e8aa02582f3906d89fd0db3f6
Instruction Fuzzy Hash: BF2114B5900248DFDB10CF9AD884AEEBBF8FF48314F14841AE958A3311C374A940CFA4

Function 0530E3C8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(00000000), ref: 0530E448

Memory Dump Source

Source File: 00000001.00000002.4134777201.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5300000_Dllhost.jbxd

Similarity

API ID: IdleInputWait
String ID:
API String ID: 2200289081-0
Opcode ID: aa995aff043cd0afeba8295b98d8414fc064773d2ba87fd1be54546ac1ce85f4
Instruction ID: 7fd87dd30cad0b1511d8910c2c09ccdcd8da7c925b9894aa1997b267da1c2a78
Opcode Fuzzy Hash: aa995aff043cd0afeba8295b98d8414fc064773d2ba87fd1be54546ac1ce85f4
Instruction Fuzzy Hash: AE21F4B0E102589FCB54CFAAD594B9EBFF9AF48310F24846AE409B7350DB749805CFA5

Function 054B4040 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 054B40C7

Memory Dump Source

Source File: 00000001.00000002.4135330208.00000000054B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_54b0000_Dllhost.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0687797341dd032470a528b7c4594bf42eb55e7026922757d7e74746e83becf3
Instruction ID: 8bf4b03794c66cb6c3bfe5f0e20bda6e36ab7789d5179c0720d8e60c310910de
Opcode Fuzzy Hash: 0687797341dd032470a528b7c4594bf42eb55e7026922757d7e74746e83becf3
Instruction Fuzzy Hash: 5421E2B5900258DFDB10CFAAD984ADEBBF9FB48320F14841AE918A3311D375A944CFA4

Function 054BBA32 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 054BB9FE

Memory Dump Source

Source File: 00000001.00000002.4135330208.00000000054B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_54b0000_Dllhost.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: aab86b38cc08324c743007bf16c2203eda2beedd6b2903cfa7ed1ed005fd38f8
Instruction ID: 6a3e50021b9ed86c98c47a8c24bad87245faeee909b6eee4b185157245bb8372
Opcode Fuzzy Hash: aab86b38cc08324c743007bf16c2203eda2beedd6b2903cfa7ed1ed005fd38f8
Instruction Fuzzy Hash: 4A1170B1A042059BEB10DB6BD844BEBB7E9EBC8214F14806AD44AE7250CBB49845CBB0

Function 054BB998 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 054BB9FE

Memory Dump Source

Source File: 00000001.00000002.4135330208.00000000054B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_54b0000_Dllhost.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4fd2d2f42fe729600a0d392b4966eff5bc302d9a858b9aa59f655ccb9f7eb0fc
Instruction ID: 54ef7ce8cf85c33d1b8a86bfaf25436719f6dd93ff9ec4c703f4dfcb457b65c2
Opcode Fuzzy Hash: 4fd2d2f42fe729600a0d392b4966eff5bc302d9a858b9aa59f655ccb9f7eb0fc
Instruction Fuzzy Hash: 47110FB5C002498FDB20CF9AC444ADEFBF4EB88224F10846AD459B7210C375A545CFA1

Function 055F17F0 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 055F26DD

Memory Dump Source

Source File: 00000001.00000002.4135555477.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55f0000_Dllhost.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: d1f2ba14470db85cf791c46d58371b5576ceb6f5b48c65d7a1f3e0e879076790
Instruction ID: 5c0bc4a5ae35d853a908ae70dd59028ed84fc5f25da798b6c427ad0387b91e32
Opcode Fuzzy Hash: d1f2ba14470db85cf791c46d58371b5576ceb6f5b48c65d7a1f3e0e879076790
Instruction Fuzzy Hash: 401142B59003488FCB20DF9AC888BDEBBF4FB48320F20841AD519A7210D778A940CFA4

Function 055F2681 Relevance: 1.5, APIs: 1, Instructions: 42comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 055F26DD

Memory Dump Source

Source File: 00000001.00000002.4135555477.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55f0000_Dllhost.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 6899a0b835ad6cdfe80cbd87a24970c3f9b2628d30646961c22655bd150d787d
Instruction ID: cd3d2e913f3854a9f0a446c4f2ff5c1ac00fae6ac3de88abda5cc765733df478
Opcode Fuzzy Hash: 6899a0b835ad6cdfe80cbd87a24970c3f9b2628d30646961c22655bd150d787d
Instruction Fuzzy Hash: 0D1142B5800248CFCB20CF99C544BDEBBF4EF08324F24841AD159B7210C338A940CFA4

Function 0127D56C Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4122977594.000000000127D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0127D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_127d000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b4db933c58c1e239354a909efe1c28d269e89f85bfe9b58c116b11e6339135e
Instruction ID: bc337ba072a48b0acb9eec6bd1f13e83588642743ac78ebfa3280cbe80cb12e0
Opcode Fuzzy Hash: 5b4db933c58c1e239354a909efe1c28d269e89f85bfe9b58c116b11e6339135e
Instruction Fuzzy Hash: DE2125B1510208DFDB05DF58E9C0B27BF65FF88314F24C569E9094B256C336D456CAA1

Function 0127D658 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4122977594.000000000127D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0127D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_127d000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acc87db8377ac890cb89f171b6a847bf63d0d7398b3156e1f80cebd14cb17160
Instruction ID: a96ca471701fc6a68d023df3bba569ee02ab1ed01feabcbe1f3343e893f56c08
Opcode Fuzzy Hash: acc87db8377ac890cb89f171b6a847bf63d0d7398b3156e1f80cebd14cb17160
Instruction Fuzzy Hash: 8D212275550248DFDB05DF58EAC0B2BBF65FF98324F20C269EA090B25AC336D456CAA1

Function 0128D0EC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4123036312.000000000128D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0128D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_128d000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ec44928f133254f36a8ba387c1805c5825dbfe38b4345932a71fa6a154665b6
Instruction ID: f6cd469033b6570a9fb11be0a3d8b07592d9b3846bc339f27ea15a52b4dd3f1b
Opcode Fuzzy Hash: 6ec44928f133254f36a8ba387c1805c5825dbfe38b4345932a71fa6a154665b6
Instruction Fuzzy Hash: 79213471550208EFDB05EF58D9C0B26BBA5FF84314F20C56DD9094B2D6C37AD84ACAA1

Function 0128D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4123036312.000000000128D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0128D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_128d000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de0067088b804edd0ead597f0df5b6404354b2c7669116ea9c44df8f77f6df27
Instruction ID: 6dcd665cfc206f4a3636440eb68819cfedb56af0c4d5eb593b6a2000d7b80076
Opcode Fuzzy Hash: de0067088b804edd0ead597f0df5b6404354b2c7669116ea9c44df8f77f6df27
Instruction Fuzzy Hash: DE210771554208DFDB05EF98D5C0B26BBA5FB84324F20C66DD9094B2DBC376D84ACA61

Function 0127D567 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4122977594.000000000127D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0127D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_127d000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: a6cbb431ae5c46f9e4531b5583811ea1430bbf2350dabbf1d39eac4b2d32e1be
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 9A11DC76404284CFCB02CF44E9C4B16BF62FB88324F24C6A9D9090B257C33AD45ACBA2

Function 0127D653 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4122977594.000000000127D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0127D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_127d000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 778edc552157317a7faa5593a234f734290d0c4cbb323fe92bf4b31036386a7c
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 4911AF76504284CFDB16CF54D5C4B16BF71FB94314F24C6A9D9090B257C336D45ACBA1

Function 0128D0E7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4123036312.000000000128D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0128D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_128d000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: def81c8301f97489ca6b8a0ee409803dc99bf7a290083ff43035c809d97ea030
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: F311DD75504284DFDB02DF58D9C4B15BFB2FF84314F24C6AAD9094B696C33AD40ACBA1

Function 0128D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4123036312.000000000128D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0128D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_128d000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: b78989024f4e258ee5109cee9f29879109ffbd98e1a5d6ae3ad40c00b12fc67e
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 4111BB75544284DFDB02DF58C5C4B15BFA1FB84324F24C6AAD9494B29BC33AD41ACB61

Non-executed Functions

Function 054B0D80 Relevance: 12.2, Strings: 9, Instructions: 912COMMON

Download Yara Rule

Strings

(o^q, xrefs: 054B0F42
(o^q, xrefs: 054B1351
(o^q, xrefs: 054B128F
(o^q, xrefs: 054B0DBE
(o^q, xrefs: 054B129F
(o^q, xrefs: 054B0E79
,bq, xrefs: 054B1230
(o^q, xrefs: 054B0EA5
,bq, xrefs: 054B1220

Memory Dump Source

Source File: 00000001.00000002.4135330208.00000000054B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_54b0000_Dllhost.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$(o^q$(o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-2735749406
Opcode ID: 585210c363c0f99acda40eead2b6202281171835f09da16195126a0cfbae1a1e
Instruction ID: 5384ea3896946133210d49978b38eb796bf8eb6984dea2b8997af7a404bb9ef3
Opcode Fuzzy Hash: 585210c363c0f99acda40eead2b6202281171835f09da16195126a0cfbae1a1e
Instruction Fuzzy Hash: B2823C30A002059FEB15CF68C594EEEBBF2FF48314F15959AE416AB3A1D771E981CB60

Function 055F3298 Relevance: 5.7, Strings: 4, Instructions: 668COMMON

Download Yara Rule

Strings

Xbq, xrefs: 055F3383
Xbq, xrefs: 055F32FD
Xbq, xrefs: 055F33CB
Xbq, xrefs: 055F32C9

Memory Dump Source

Source File: 00000001.00000002.4135555477.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55f0000_Dllhost.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq
API String ID: 0-2732225958
Opcode ID: 6b072824f2b59ba41f70fa62bda61158ebf42cc34e57941ca2dff1a3010d8d1d
Instruction ID: 710a6c8201e583d47e396e88fae5a48fe26ad11695991f61a8a6861b431ef87a
Opcode Fuzzy Hash: 6b072824f2b59ba41f70fa62bda61158ebf42cc34e57941ca2dff1a3010d8d1d
Instruction Fuzzy Hash: FF32622B600A11CBDB054B4EDCD37EE73B5FF4022C78B8871DA909E61BEE60D0A59384

Function 055F93C9 Relevance: 2.8, Strings: 2, Instructions: 269COMMON

Download Yara Rule

Strings

$^q, xrefs: 055F93EE
Xbq, xrefs: 055F9407

Memory Dump Source

Source File: 00000001.00000002.4135555477.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55f0000_Dllhost.jbxd

Similarity

API ID:
String ID: Xbq$$^q
API String ID: 0-1593437937
Opcode ID: 7dce3e9f733a6d9b8a52b1aeb6735adb7aef137324d661c253403941991e68ba
Instruction ID: c3cc3aef5e881b7ba08eb5bc569de893a5c03d2c3649fc13642dabffc19e7949
Opcode Fuzzy Hash: 7dce3e9f733a6d9b8a52b1aeb6735adb7aef137324d661c253403941991e68ba
Instruction Fuzzy Hash: 7C917375F046198BDB58EB79985877E77B7BFC8700B14892DE507EB388CE3488028795

Function 055F82C0 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\VTm, xrefs: 055F850B

Memory Dump Source

Source File: 00000001.00000002.4135555477.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55f0000_Dllhost.jbxd

Similarity

API ID:
String ID: \VTm
API String ID: 0-628799665
Opcode ID: 8bd86a05dd9af68f54650d683ccfbbd828d88094a9053086b10a92909042b920
Instruction ID: 218fdb6da004b9348f005aae9a51ca590b79940cec155135254e0fb2fe604fb8
Opcode Fuzzy Hash: 8bd86a05dd9af68f54650d683ccfbbd828d88094a9053086b10a92909042b920
Instruction Fuzzy Hash: 6F9160B0E00209DFDF14CFA9C9957EEBBF2BF88314F148529D519AB294EB749845CB81

Function 054BBE80 Relevance: .5, Instructions: 525COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135330208.00000000054B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_54b0000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb1a76412474000523ece52394bb462e84113458bb294bf3a78f66c4eebebe53
Instruction ID: 2b78a7591a23d33c65339ceb51b565cb3599096b9a742be9a462ea4984171195
Opcode Fuzzy Hash: fb1a76412474000523ece52394bb462e84113458bb294bf3a78f66c4eebebe53
Instruction Fuzzy Hash: 0E5259B85A070AEFE760CF94E48A19A7FF3FB40314B506219E1615B2D0DBB8658BCF44

Function 054B95D8 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135330208.00000000054B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_54b0000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5be99df118d97085850e90b1c0912855a9888131ac9a13cb0de561b08f78c51
Instruction ID: 66c3ab560624c08801156c1d5e7f0215379f401755b789bdd8b3f74921139e90
Opcode Fuzzy Hash: f5be99df118d97085850e90b1c0912855a9888131ac9a13cb0de561b08f78c51
Instruction Fuzzy Hash: 03A17032E00205CFDF05DFB5C8445EEBBB2FF84300B1545AAE906AB261DB71E956CB50

Analysis Process: Server.exePID: 6944, Parent PID: 1044COMMON

Executed Functions

Function 011B8E08 Relevance: 2.6, Strings: 2, Instructions: 105COMMON

Download Yara Rule

Strings

Hbq, xrefs: 011B8ED5
Hbq, xrefs: 011B8E76

Memory Dump Source

Source File: 00000004.00000002.1847923719.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11b0000_Server.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: a8f117a94bbf251a5da6ed47bf5ff436d6135f423d36b85d71f4aab32ca1ead9
Instruction ID: bddf1672b5445d2f46309cb205aef93521d2addcf4ed7b44195d6cca4ffacc55
Opcode Fuzzy Hash: a8f117a94bbf251a5da6ed47bf5ff436d6135f423d36b85d71f4aab32ca1ead9
Instruction Fuzzy Hash: 0131B430B002058FDB5DAE7C94906BF29ABABC4750B25852CEA19DB3D4DF34CD0287E2

Function 011B81A1 Relevance: 1.7, Strings: 1, Instructions: 475COMMON

Download Yara Rule

Strings

dbq, xrefs: 011B8485

Memory Dump Source

Source File: 00000004.00000002.1847923719.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11b0000_Server.jbxd

Similarity

API ID:
String ID: dbq
API String ID: 0-1887291361
Opcode ID: db97a598769418bdf3802c7ebf799ba856b29d6670e827dfb676184c8e0ee1ee
Instruction ID: 415b62224f84f92d1e0d5adc49e0c154ed50e45781bdaeb9ad7c87b5f6afb7f8
Opcode Fuzzy Hash: db97a598769418bdf3802c7ebf799ba856b29d6670e827dfb676184c8e0ee1ee
Instruction Fuzzy Hash: 8F222874A00218CFDB19EF24E994BA9BBB2FF48305F1045A9E909E73A4DB719D81CF51

Function 011B8424 Relevance: 1.6, Strings: 1, Instructions: 305COMMON

Download Yara Rule

Strings

dbq, xrefs: 011B8485

Memory Dump Source

Source File: 00000004.00000002.1847923719.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11b0000_Server.jbxd

Similarity

API ID:
String ID: dbq
API String ID: 0-1887291361
Opcode ID: 60ac920aa50d63c5047a5e1c6dd2a77ef8dc5244dc7cbe55a145ae880145dffd
Instruction ID: 5a23d58067c55ad8ae9b6aef97ace7112967b9c3acd00d5b21032e1d8d6b9de2
Opcode Fuzzy Hash: 60ac920aa50d63c5047a5e1c6dd2a77ef8dc5244dc7cbe55a145ae880145dffd
Instruction Fuzzy Hash: 1BE1E674A00258CFDB19EF74D994BA9BBB2FF48305F1041A9E80AA73A4DB359D81CF51

Function 011B7827 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

Te^q, xrefs: 011B796A

Memory Dump Source

Source File: 00000004.00000002.1847923719.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11b0000_Server.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 21e4bbf5a763a0306eb3b6878148c304a13cdeede1dd3811e63758638e0483d2
Instruction ID: 0a397eb9ec4f11dd57ef6b3566481f35a090f4cf1d7b2d816be797a0657053f7
Opcode Fuzzy Hash: 21e4bbf5a763a0306eb3b6878148c304a13cdeede1dd3811e63758638e0483d2
Instruction Fuzzy Hash: 4A51AA746442859FCB06FF68E995B89BBB1FF44305B008665D405CB36EDBB0AD89CF90

Function 011B7838 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

Te^q, xrefs: 011B796A

Memory Dump Source

Source File: 00000004.00000002.1847923719.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11b0000_Server.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 22c3ad4ac5e5344cd527d511fd40ed0007040018ae34c18bcfdb8d701004619e
Instruction ID: 6f105fd6d260315ab15b4e54e9abefa45684b3d0edeb607f7a861ca04e059d91
Opcode Fuzzy Hash: 22c3ad4ac5e5344cd527d511fd40ed0007040018ae34c18bcfdb8d701004619e
Instruction Fuzzy Hash: B65178346442869FCB06FF68E985B99BBB1FF44305B009665D405CB36DEBB0AD89CF90

Function 011B0DCF Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

4'^q, xrefs: 011B0DA8

Memory Dump Source

Source File: 00000004.00000002.1847923719.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11b0000_Server.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 363d3b20d1cb75313d1e0ecf056b03f8b51ee3ca342a17f3fcc93ccd039c349e
Instruction ID: 875b9f16e2971f9a2cd49a40972a954fe1aa25b87e8e0a3a813f82c7b24c2593
Opcode Fuzzy Hash: 363d3b20d1cb75313d1e0ecf056b03f8b51ee3ca342a17f3fcc93ccd039c349e
Instruction Fuzzy Hash: 8931AF706443459FC719EF38E9406AE7BB6FB81304B104A69D0459B3A8DF71DD89CB91

Function 011B9219 Relevance: .5, Instructions: 525COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1847923719.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff0411e4df30daae9007f55d961797c47287a3ab0fac74f1adc7e43a9b41e249
Instruction ID: 79f2d1bddb22ca6ecfdd9fdeaf1c75f16fd27df212f94272b21d64a3b7bc74c3
Opcode Fuzzy Hash: ff0411e4df30daae9007f55d961797c47287a3ab0fac74f1adc7e43a9b41e249
Instruction Fuzzy Hash: 8AF028B12052044FD726DBBCD965298BFF0EF4A2107054AAAD845CB398EF359E468B52

Function 011B3DF0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1847923719.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc85e97ba18ac23cd569ec4fe28453687309b5f9f4af38d8b31fb9f293664ca2
Instruction ID: 02ae68db0bd4cca7bbd289a28acf1e9df1856b2fb24b978b5f4decb41626a791
Opcode Fuzzy Hash: cc85e97ba18ac23cd569ec4fe28453687309b5f9f4af38d8b31fb9f293664ca2
Instruction Fuzzy Hash: CA41B230B003059FDB45EB78D8547AF3BBAAB84700F104469E409D73A8DF39DD458BA2

Function 011B3E00 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1847923719.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4da42a32489d49ee6667c703a89c8ddabf319f0e460dfaa311f91a088f82f29
Instruction ID: 0f29b72b39041aafe0aa2bd325e582bd13ebc107d689e40d6ad53eeca9ade2b4
Opcode Fuzzy Hash: c4da42a32489d49ee6667c703a89c8ddabf319f0e460dfaa311f91a088f82f29
Instruction Fuzzy Hash: 3E319E30B403159FDB49EB78D8547AE7BBAAB88700F104469E409D73A8DF399D458BA2

Function 011B0890 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1847923719.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9d864aaf21554ea247da13d5346e968c28f481f5423df34e0ceece6bc07aae4
Instruction ID: 7b457151af19e27ec739c8a9650fb88b3f53f9017565447be9812e0a9178c853
Opcode Fuzzy Hash: a9d864aaf21554ea247da13d5346e968c28f481f5423df34e0ceece6bc07aae4
Instruction Fuzzy Hash: 7E316BB19003489FDB18DFA9D8857DFBFF5EF48324F208869E519A7290D735A940CB90

Function 011B9748 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1847923719.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 601496d3cb27be1b36b0aa1e23a34a0d6a137b484003eb481f2413e7daa39290
Instruction ID: c5aef313bb988cacea885e4535142525dc74075240238d4c6baede051a323747
Opcode Fuzzy Hash: 601496d3cb27be1b36b0aa1e23a34a0d6a137b484003eb481f2413e7daa39290
Instruction Fuzzy Hash: F621E4B57083488FC709AF7CE99496A7BF9FB8530031104A9E605C7392DF24EC058BB2

Function 011B0994 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1847923719.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7c3e4e67e7b0b515320506c698875bdde774f594e22a576c1a031df79bed2ab
Instruction ID: ac9bcab8fdd80a74c76b4409ccbfe1273b083193ce042f53cf05cae879d86290
Opcode Fuzzy Hash: c7c3e4e67e7b0b515320506c698875bdde774f594e22a576c1a031df79bed2ab
Instruction Fuzzy Hash: 8931E0B0D01208DFDB14CFA9D584BCEBFF5AF48310F24812AE408BB264DB75A945CB94

Function 011B09A0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1847923719.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14d7b72a03ce4bdea94123102a991bdcc776357833c20fedf9050e509da22ec9
Instruction ID: f0e498e4f0ad1867895ed8dcb46008a22e504c2a875b5c915aa9c27f9a444b0c
Opcode Fuzzy Hash: 14d7b72a03ce4bdea94123102a991bdcc776357833c20fedf9050e509da22ec9
Instruction Fuzzy Hash: 0531DEB0D01248DFDB18CFA9D584BCEBFF5AF48310F24856AE408BB264CB75A945CB94

Function 011B3CE9 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1847923719.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89993e46ba6a230b9c1e4ff849067c4521f7867ffe0b789b0b8f283dcad23ded
Instruction ID: 6f4bbe70670524701f177cd12a694b0e8d440a8534f74d29122877c41ab32bad
Opcode Fuzzy Hash: 89993e46ba6a230b9c1e4ff849067c4521f7867ffe0b789b0b8f283dcad23ded
Instruction Fuzzy Hash: A5214F74A0024A9FCB05EFA8E9965ADBB72EF85301F404568D905F73A5DF306E488F71

Function 011B9620 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1847923719.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b703f04c95823dd1c5c995a9cf3e16dd0acdd4b520024e903ae72553f21362d5
Instruction ID: 7467fd5b23067df368a93015a47871fd51e2df20e6dbc7116812281c454578db
Opcode Fuzzy Hash: b703f04c95823dd1c5c995a9cf3e16dd0acdd4b520024e903ae72553f21362d5
Instruction Fuzzy Hash: FC1101316002044FD708AB78D99855A3BB2FBC5311B1549B9E046CB3A5EF34CD4A87A0

Function 011B9738 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1847923719.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5ff920de4b8fef401f41e75abea104a775583527f59cd0176928ed37c4a4cf6
Instruction ID: 1c7dcf36bf0f606284a4f271d90e90f661858101f1f9282b642ae4875a9fdf80
Opcode Fuzzy Hash: e5ff920de4b8fef401f41e75abea104a775583527f59cd0176928ed37c4a4cf6
Instruction Fuzzy Hash: E701CCB53047049FC7189F69E8E486A7BF8FB8A21431505AAE215C7392DB34EC018BB1

Function 011B3CF8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1847923719.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc6c25696431eab7c80a0203b485f2c19ceb24c6daf9bafb92d9a3b9187f26b2
Instruction ID: 59c8ef3912b2477ab11179a11b43f07e9922401a231c394824e03b2f4bf6fbce
Opcode Fuzzy Hash: fc6c25696431eab7c80a0203b485f2c19ceb24c6daf9bafb92d9a3b9187f26b2
Instruction Fuzzy Hash: C611CC34A0020A9FCB05EFA8E9565ADBB76EF84301F404528D905B73A5DF31AE489FB1

Function 011B0DE0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1847923719.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d773343c65cbad2193f85deb08912393abfffdd03f7f53d0579c2884f3264378
Instruction ID: f9883cc9e412aebd86a2819dc714010dd97e35920b95824f03178ae912cb7288
Opcode Fuzzy Hash: d773343c65cbad2193f85deb08912393abfffdd03f7f53d0579c2884f3264378
Instruction Fuzzy Hash: 4D11AC712407409FC318EF29D50069ABBEABB813157108A2DD0598F3A8DFB5ED898FE1

Function 011B08F8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1847923719.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2be55c905e83a7963d648c36410f6d029392c6fc5547b1bc356358c1f49f736b
Instruction ID: a30ae3532d265a62985572078cc74b2f77834bfaa148f6148bac973d3a76dc59
Opcode Fuzzy Hash: 2be55c905e83a7963d648c36410f6d029392c6fc5547b1bc356358c1f49f736b
Instruction Fuzzy Hash: 301122B5D003598FDB20CFAAD584BDEBFF4EB48324F20845AD459A7250C375A944CFA0

Function 011B0900 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1847923719.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c38ce52518d8078dd385d3aedab9cae13b6c86ba4775b2a40b5f8b43dfee961
Instruction ID: 2b0895f065df74bfff8c189969d41bd52acb26a573df69544eb3fdc63ee4bf7d
Opcode Fuzzy Hash: 4c38ce52518d8078dd385d3aedab9cae13b6c86ba4775b2a40b5f8b43dfee961
Instruction Fuzzy Hash: 541130B58003088FDB20DFAAC484BDEBFF4EB48320F208419D559A7250C335A940CFA0

Function 011B76A8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1847923719.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccfe5ebeab5b1f0f96309f29b2a57cd24f777dc2e9b456768d4382d1d1f2ff95
Instruction ID: 91678fef6b11c717f0750f7d09865d440851798160d6382ce9dbdff5f610ddcb
Opcode Fuzzy Hash: ccfe5ebeab5b1f0f96309f29b2a57cd24f777dc2e9b456768d4382d1d1f2ff95
Instruction Fuzzy Hash: 5B018F347092518FCB06EB3CD69461A7BE1AF8A311F424869D0C5CB3A4DB34EC00CB92

Function 011B0880 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1847923719.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed0408cfc7f01c21f6ad2227a68fdebeae8bef3f931835d3834616dca493356c
Instruction ID: 3ef4f472bcd1d75dd679030c53c6be234f73dab118f1dd85c4a664f3978554d5
Opcode Fuzzy Hash: ed0408cfc7f01c21f6ad2227a68fdebeae8bef3f931835d3834616dca493356c
Instruction Fuzzy Hash: 51F062B2A04304AFDB0C9B7598856EF3F76EFA9214F548969E105D72D0DA72C9018740

Function 011B0EA0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1847923719.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc27f5cad6f16b94acc4bccacb9006b3fb55ca8b78a42aed7d368ce2a3904d8d
Instruction ID: e969a626c3fc196cd79d64cb46e83e36f946c58d81a7892be610d0321380f729
Opcode Fuzzy Hash: bc27f5cad6f16b94acc4bccacb9006b3fb55ca8b78a42aed7d368ce2a3904d8d
Instruction Fuzzy Hash: EEF0A0716083508FC3095B78A8501EA7BB6FA8925135449BAE049CE368DB69C94BC792

Function 011B0839 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1847923719.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03e423991134f8a923238b1957f37d8043ee1004f253e46a4896771f1eeac6fa
Instruction ID: d201832439830c92f5a2373b4743061a6d73ba78836a9ea0f70d3e0acb26d2a9
Opcode Fuzzy Hash: 03e423991134f8a923238b1957f37d8043ee1004f253e46a4896771f1eeac6fa
Instruction Fuzzy Hash: 77E04F700493C84FC743AB24EC157403F74A702209F040192D844CB37BC6A85A8C87E6

Function 011B95F0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1847923719.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d0a6da08cde20e2cd31e142cc65d54ed472fbed34a32978731f74f6fe8cb2ec
Instruction ID: 4b58de9e2cc13bd90b8ce808d1887e9f88d064bed4599b1ddca03e8b34493f52
Opcode Fuzzy Hash: 4d0a6da08cde20e2cd31e142cc65d54ed472fbed34a32978731f74f6fe8cb2ec
Instruction Fuzzy Hash: 2FD0A7716402089BCB14EFB4452116EBBE9DB44110B404AA9A44AC7284EE358F404792

Function 011B0848 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1847923719.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df01ef2bba417a5b7a3a115e01322486df9f8cdf6da899e601f746aab427f2e9
Instruction ID: ab029f43d34b62d9f1afef69bf908638944ca9cc6e441d223cf024e53160e936
Opcode Fuzzy Hash: df01ef2bba417a5b7a3a115e01322486df9f8cdf6da899e601f746aab427f2e9
Instruction Fuzzy Hash: 76D09E701843858ECB52EB18F9457457F69B750209F040550D4048B339D7A9599887E6

Analysis Process: Dllhost.exePID: 1852, Parent PID: 2580COMMON

Executed Functions

Function 051581A1 Relevance: 1.7, Strings: 1, Instructions: 462COMMON

Download Yara Rule

Strings

dbq, xrefs: 05158485

Memory Dump Source

Source File: 00000006.00000002.1951847770.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5150000_Dllhost.jbxd

Similarity

API ID:
String ID: dbq
API String ID: 0-1887291361
Opcode ID: d894729812a03b3583f0b3653d094841c9625b525df712a3a7d17ff76b2d3300
Instruction ID: 7facec3ac552b88934e1ba0184511cfb94bf60616e686362f439c905aa3c65b2
Opcode Fuzzy Hash: d894729812a03b3583f0b3653d094841c9625b525df712a3a7d17ff76b2d3300
Instruction Fuzzy Hash: 94227F75A01214DFDB25EF30E898BA97BB2FF48714F1045A9E919A7398DB319D82CF40

Function 05158424 Relevance: 1.6, Strings: 1, Instructions: 305COMMON

Download Yara Rule

Strings

dbq, xrefs: 05158485

Memory Dump Source

Source File: 00000006.00000002.1951847770.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5150000_Dllhost.jbxd

Similarity

API ID:
String ID: dbq
API String ID: 0-1887291361
Opcode ID: 87bfaf03c73362d784aabc7718c80c896a66584379dc50ac74c40ccf6b59c5d9
Instruction ID: ca41d9f0d7f58c1e502473903e4902e8c628e6905772e1f5e36944ce8e66a7d7
Opcode Fuzzy Hash: 87bfaf03c73362d784aabc7718c80c896a66584379dc50ac74c40ccf6b59c5d9
Instruction Fuzzy Hash: 54E10B74A01214DFDB25EF74D898BA9BBB2FF48714F1044A9E809A7399DB359D82CF40

Function 05157728 Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

Te^q, xrefs: 0515786A

Memory Dump Source

Source File: 00000006.00000002.1951847770.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5150000_Dllhost.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 47f8025b975f7e5339d63ec20f89731fc9f03d1016a53c5e628500bbe5372bf7
Instruction ID: 4490d080254c291dbafd35a117a802f1d423b31905b873a9746f540e6e0cf8fc
Opcode Fuzzy Hash: 47f8025b975f7e5339d63ec20f89731fc9f03d1016a53c5e628500bbe5372bf7
Instruction Fuzzy Hash: B251DE36640246AFDB02FF68F9A4949BFB2FB44704B009664D0049736DDB70A94BCF90

Function 05157738 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

Te^q, xrefs: 0515786A

Memory Dump Source

Source File: 00000006.00000002.1951847770.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5150000_Dllhost.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 5039e3e974de4d304afdf37b8d0d073f03aa51e8c9bdf8874fa28e4ab745dae7
Instruction ID: 7e1c63ff2235c4692ec756192a7474b59f0e03f8223914ace89dc22be8d13545
Opcode Fuzzy Hash: 5039e3e974de4d304afdf37b8d0d073f03aa51e8c9bdf8874fa28e4ab745dae7
Instruction Fuzzy Hash: 6851CE35640246AFDB02FF68F9A4949BFB6FB44704B009664D0049736DDB70A94BCFD0

Function 05150DCF Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05150DA8

Memory Dump Source

Source File: 00000006.00000002.1951847770.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5150000_Dllhost.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: d0d8c42edd191bf42d66c84c64a6ecd6d39f88ccc8c0eb3ec0bf7e814de924a6
Instruction ID: 38ba8f4b27d3b0ac5a5534b669f6c7a0b74df44019c4c586a6159cc85cf8002a
Opcode Fuzzy Hash: d0d8c42edd191bf42d66c84c64a6ecd6d39f88ccc8c0eb3ec0bf7e814de924a6
Instruction Fuzzy Hash: 1A31BF31600345AFC715EB78E8046AE7BB6FB81314B008A6DD0559B3A8DF71ED8ACBC1

Function 051592C8 Relevance: .5, Instructions: 494COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1951847770.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5150000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2123bff32ff519cc83f97158b5b3561449eb63f264aab4f55cd913b4e1965632
Instruction ID: 33a7fe3da40f00b281d8544f1a1bce9d676f0b41d3004d5a2a96cb37197dbfe1
Opcode Fuzzy Hash: 2123bff32ff519cc83f97158b5b3561449eb63f264aab4f55cd913b4e1965632
Instruction Fuzzy Hash: 4AE0DF71A163486FCB11DBB0A4153B97FE8EF01212F044DAAA886C21A2EE385A008782

Function 05159295 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1951847770.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5150000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 757e548c90b5144efc39de00eea2ea30749a77fc375c4d4e465e5312d7795ad8
Instruction ID: f07d9f319f0d4844a266403ee3e26bd23d66896239b2cf2f8620933c5a3a25ab
Opcode Fuzzy Hash: 757e548c90b5144efc39de00eea2ea30749a77fc375c4d4e465e5312d7795ad8
Instruction Fuzzy Hash: 2BE0E571A0A3488FCB46DBF494146BD3BA4EF01111F04499AD58187157EE344A008392

Function 05153DF0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1951847770.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5150000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ea4ebf674369cb5dcb93c7818b550235177bf183673851fcee540ef414eacfb
Instruction ID: 4eeae6fc6261fce1987e0f3af52bc4e0c7bc2cb971f5c6404f0e0de006f8cda4
Opcode Fuzzy Hash: 8ea4ebf674369cb5dcb93c7818b550235177bf183673851fcee540ef414eacfb
Instruction Fuzzy Hash: D341A331F10205EFDB15FF78E81876E7BAAEB84710F004869E409D7398DB399C468B91

Function 05153E00 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1951847770.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5150000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b9969816dcb9a394e942dcce42155b1eb89184c0bc430b2ce883e390f508d8e
Instruction ID: 09791efc2a8199ccc083db1ab7d5b815d5abee9a025a9fa11aa3f7e7b43bb17c
Opcode Fuzzy Hash: 5b9969816dcb9a394e942dcce42155b1eb89184c0bc430b2ce883e390f508d8e
Instruction Fuzzy Hash: 88318431F10214EFD715FF78E81876E7BAAEB84710F104869E509D7398DB359C468B91

Function 05150890 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1951847770.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5150000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bded954b31e3c3b7ddd98b03f36008015497a3b83799dfe8361aacd47768250
Instruction ID: b8be30e8b01fa76a8e5ce6f9c6d6bb8d1f31297442f5d505c4dc5d3e1fd198fa
Opcode Fuzzy Hash: 4bded954b31e3c3b7ddd98b03f36008015497a3b83799dfe8361aacd47768250
Instruction Fuzzy Hash: 71318BB1E00348DFDB14DFB9D84869EBFF5EF48320F108469D529A7295D735A844CB90

Function 051597E8 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1951847770.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5150000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94a0183b96099bd68be56a0743aee57e0e51fdc8fb852c5835bf12fe4c725b6a
Instruction ID: 6701ddfcdc30030431c3924bbf0833e9d06af99967b6ea60bf9314549faec4d0
Opcode Fuzzy Hash: 94a0183b96099bd68be56a0743aee57e0e51fdc8fb852c5835bf12fe4c725b6a
Instruction Fuzzy Hash: DA210372704204DFC714DB78E988A297BB6FB89320B1505A9D91AD7395CF30EC09CBA2

Function 05150994 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1951847770.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5150000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9b4491adb8ce2d72a947ff932756a880cf3c6839f349b449b7f6765349e012c
Instruction ID: c0cf4d2eb0e9f5ba75dcf9a794fa176bd2ec19782812f700632da3c2a433795d
Opcode Fuzzy Hash: d9b4491adb8ce2d72a947ff932756a880cf3c6839f349b449b7f6765349e012c
Instruction Fuzzy Hash: 3131F2B4D01248DFDB14CFE9D584B8DBFF1AF48310F24806AE409B7254C7759945CB90

Function 051509A0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1951847770.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5150000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 747d9b8e86653588d0272a7ccacfac12587ddd6118fcaa6ca308d65f7101afc6
Instruction ID: 768c4cc114d04700c43457290d1e989bf5649fbef41001231e43643bd30c2f2c
Opcode Fuzzy Hash: 747d9b8e86653588d0272a7ccacfac12587ddd6118fcaa6ca308d65f7101afc6
Instruction Fuzzy Hash: 4B31D0B0D02248DFDB24CFD9D588BCDBBF5AF48310F24802AE419BB264DB75A945CB94

Function 05159AE8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1951847770.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5150000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99cee901ad218ba68e71f732cc6073c1e9da4a25108b022227a9f4a901f915ae
Instruction ID: 6ccc36d1bc3a79e6d276de315dbaba1436741281decb2c10a748a8ad590e5153
Opcode Fuzzy Hash: 99cee901ad218ba68e71f732cc6073c1e9da4a25108b022227a9f4a901f915ae
Instruction Fuzzy Hash: 0A01C036F05110DFD705572DB858A6ABBAAEFC4271B09007AE919D73A2CF719802C6A5

Function 05153CE9 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1951847770.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5150000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ab9bc9b5334e1790c7c723774b59c5021eb3437ae988945601b52294f32c508
Instruction ID: 7284c1c07265d02a6a395671df43cf827750c21d08333fb79e2f586691445b7d
Opcode Fuzzy Hash: 5ab9bc9b5334e1790c7c723774b59c5021eb3437ae988945601b52294f32c508
Instruction Fuzzy Hash: BB214235E1010AAFCB44EFA9F8455ADBB71FF84711F40466CD205A7398DB706949CFA1

Function 05153CF8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1951847770.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5150000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fbb9c6fa0f8114f9745e8dc0bbc9f47904414ed9e257994b22d346e914574e0
Instruction ID: 60d96928a956e671fd72a536089274f40a2d38b945b2aabfbfc83badf15b94a2
Opcode Fuzzy Hash: 4fbb9c6fa0f8114f9745e8dc0bbc9f47904414ed9e257994b22d346e914574e0
Instruction Fuzzy Hash: 0D112B35E1010AAFCB45EBA9F8555AEBB75FF84700F40496CD205A7398DB30AA49CBA1

Function 051597D9 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1951847770.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5150000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba1ad242c35f82c2f93561b5809953ecf978c9b884c7be992459b9325e28e7d
Instruction ID: 123b85edc95a00037cbce7fe31366dd0888b931637ce6f50027715e7359ba4b7
Opcode Fuzzy Hash: 9ba1ad242c35f82c2f93561b5809953ecf978c9b884c7be992459b9325e28e7d
Instruction Fuzzy Hash: AD019E72B10214EFCB149F69E98893977B9FB496217154569E925C7351CB30EC04CBA2

Function 05150DE0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1951847770.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5150000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41302b7ebb9adc0159fed8c54ce6cf388347bae988c5d26a6ec6fe6964220fc0
Instruction ID: 28552e4efde715f3e7e0c8d70c8fceefa54b503efb0a7f434a892d3f22da9734
Opcode Fuzzy Hash: 41302b7ebb9adc0159fed8c54ce6cf388347bae988c5d26a6ec6fe6964220fc0
Instruction Fuzzy Hash: 9C11A0322007009FC314EB79E4085AA7BE6BB813147008E2DC05A5F7A8DFB5EC8A8FC1

Function 051508F8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1951847770.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5150000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 442a67aafa5eb953534f2857ae8a4cc326e580fe3704d479c62b1b42407b0c01
Instruction ID: cbf266ec5002c3d540eb88dbe3fbb4b7e1026e8122c0ff627fc01c8a97219f29
Opcode Fuzzy Hash: 442a67aafa5eb953534f2857ae8a4cc326e580fe3704d479c62b1b42407b0c01
Instruction Fuzzy Hash: 5F1122B5900248CFCB20DF9AC588BDEBBF4EB48324F248419D869A7354C339A944CFA4

Function 051596C0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1951847770.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5150000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dafdbaab42237b263ec0bb7b1c46093de4d3ca873d691e3b702de5db1eebf9a9
Instruction ID: 6c9546283c2384c87e9dcfea4e03471b3aed9413010857aed7921b097cce715a
Opcode Fuzzy Hash: dafdbaab42237b263ec0bb7b1c46093de4d3ca873d691e3b702de5db1eebf9a9
Instruction Fuzzy Hash: 6301D6326172804FC7026B78B9A956A3F61EF8612130950EAE545CB3A7DE34DC05C795

Function 05150900 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1951847770.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5150000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3666eb953bca585fa96f5f3910e10009217763eebe065b70c13146e439c827b
Instruction ID: 2a88dc3db68d4d04ee291c56fe08064042a1640ef6f599998ea92bb4f52c667c
Opcode Fuzzy Hash: f3666eb953bca585fa96f5f3910e10009217763eebe065b70c13146e439c827b
Instruction Fuzzy Hash: AE1130B1800208CFCB20DFAAC448BDEFBF4EB48324F208419D469A7354C339A944CFA0

Function 051576A8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1951847770.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5150000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2062687cadc223b52c35465c09be27bed6d05477f48a0c8e74f71935af28ba7e
Instruction ID: 4388a2d8d6dbbd165f6fd51f47ff82cf88ce0203420a1b1f14221443c43c9484
Opcode Fuzzy Hash: 2062687cadc223b52c35465c09be27bed6d05477f48a0c8e74f71935af28ba7e
Instruction Fuzzy Hash: DA017C74308255CFDB12EB7CD5487297BE2AF8A320F0149ADD4D18B3A4DB34A841CB82

Function 05150EA0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1951847770.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5150000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2355414bded8edf971c61fbff7d5a9c0cdfb9211717be2c75b1cfb5dd5a65015
Instruction ID: 20c64531fcf404bdabe8a06e615e977efb1dc549ef22b30fc3dc058c688be21e
Opcode Fuzzy Hash: 2355414bded8edf971c61fbff7d5a9c0cdfb9211717be2c75b1cfb5dd5a65015
Instruction Fuzzy Hash: F1F05C326043008FC3195BB8A8180A93FA3E98535434009BAD055CF36CDB79C947C381

Function 05159AD8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1951847770.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5150000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d45bc3c9b9a9227c698615ce09aa5e50ef393a08f2537393f1437d2bf8c08a2d
Instruction ID: effc726f44c6eeaf3a826ec1f35bf31b25bc5610ac2038536582162e24bf7607
Opcode Fuzzy Hash: d45bc3c9b9a9227c698615ce09aa5e50ef393a08f2537393f1437d2bf8c08a2d
Instruction Fuzzy Hash: 43D0C737E5912093C304122EA8087A67AAEDBC1231F18007AE91DD3682CAA6AC02C2A5

Function 05159690 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1951847770.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5150000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 002abe75bc26a5343416b26e8a1666546f2d478ef42971d48f582aeeacd892c0
Instruction ID: 05c1d8b9de9586224cd75862eefedd00b1b457b18b9c3b5f4edcf6a5127d5271
Opcode Fuzzy Hash: 002abe75bc26a5343416b26e8a1666546f2d478ef42971d48f582aeeacd892c0
Instruction Fuzzy Hash: BBD0A73164120C5BCF14EFB4541516E7BE9DF44100B404D99A44AC7245ED719E004792

Function 051596D0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1951847770.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5150000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05a4e98d67c6b3b8f5c60e0ca4cba46804b059f36885565730d2a14276ead76f
Instruction ID: 4591917efa6a44643447c0e93101274cf1e8aa7cfa34ea965b027128ec83d687
Opcode Fuzzy Hash: 05a4e98d67c6b3b8f5c60e0ca4cba46804b059f36885565730d2a14276ead76f
Instruction Fuzzy Hash: C4D0C9316133188BCB182A78B04D4697B99EF8912230414B9F50AC3782DE76EC018780

Function 05150839 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1951847770.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5150000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebdd724e0881490180f5031045775633521aaacb65b7007cde800f1deb266b24
Instruction ID: 903a998755667731a65f236b06ba4e92f7446b2ff5a947b97fb79acb2e1b61a7
Opcode Fuzzy Hash: ebdd724e0881490180f5031045775633521aaacb65b7007cde800f1deb266b24
Instruction Fuzzy Hash: 65E012314052C59FD711FBA8FA087007F21EB42304F040565D0841B77FD7B152A9C7D1

Function 05150848 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1951847770.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5150000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5845b325650bc6d31861ea83ed2c9d36dd655728dcbb9b89c707b633718a7e2
Instruction ID: 04fc5fe1c6e1dfece5b9b6e8021968dfbb6640d8738979785f3d3c29e4dd8cda
Opcode Fuzzy Hash: e5845b325650bc6d31861ea83ed2c9d36dd655728dcbb9b89c707b633718a7e2
Instruction Fuzzy Hash: 6DD022324052C99FCB22FB68F80D701BF58F741308F000160D0080B72ECBB1A48E8BC0

Analysis Process: Dllhost.exePID: 3300, Parent PID: 2580COMMON

Executed Functions

Function 04D98E98 Relevance: 2.6, Strings: 2, Instructions: 105COMMON

Download Yara Rule

Strings

Hbq, xrefs: 04D98F06
Hbq, xrefs: 04D98F65

Memory Dump Source

Source File: 00000009.00000002.2036629585.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d90000_Dllhost.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: 5ac85703f38be59d558b8e6718721875f1640c099ad918d24bee1cdd442ba0ad
Instruction ID: 06097d356227433784a4e1ea3a89b2f710a0a93b58f3aa02008140f7f14520e9
Opcode Fuzzy Hash: 5ac85703f38be59d558b8e6718721875f1640c099ad918d24bee1cdd442ba0ad
Instruction Fuzzy Hash: FD31C031B005058FCB58BF7D881467F29E3ABC5750B249629E60AEB384EF35EE0293D1

Function 04D980C0 Relevance: 1.8, Strings: 1, Instructions: 537COMMON

Download Yara Rule

Strings

dbq, xrefs: 04D98475

Memory Dump Source

Source File: 00000009.00000002.2036629585.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d90000_Dllhost.jbxd

Similarity

API ID:
String ID: dbq
API String ID: 0-1887291361
Opcode ID: 812cb736eb9ad225785f0becae1ee9be4e6da3faab6a1988be4b619cae974339
Instruction ID: 15354e7599e04b3aaf4cb046d59ef897bdae5f9000a966b5c41938504db5fcf7
Opcode Fuzzy Hash: 812cb736eb9ad225785f0becae1ee9be4e6da3faab6a1988be4b619cae974339
Instruction Fuzzy Hash: A1221674A00215CFDB15EF24DC94BA9BBB2FB88304F1045E9E519A73A8DB71AD85CF50

Function 04D9819F Relevance: 1.7, Strings: 1, Instructions: 431COMMON

Download Yara Rule

Strings

dbq, xrefs: 04D98475

Memory Dump Source

Source File: 00000009.00000002.2036629585.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d90000_Dllhost.jbxd

Similarity

API ID:
String ID: dbq
API String ID: 0-1887291361
Opcode ID: 8dc4c9bbad5ab27a2a85098643a1fd316679b5d131eb4b4f2c56b12389891d3b
Instruction ID: a01ef2dade08eb9909a1b7594c5b101f72b2aa71316121b802416b3a468af9ca
Opcode Fuzzy Hash: 8dc4c9bbad5ab27a2a85098643a1fd316679b5d131eb4b4f2c56b12389891d3b
Instruction Fuzzy Hash: 2A221678A00215DFDB19EF21D884FA977B2FB88704F1045E9E509AB3A8DB71AD85CF50

Function 04D98414 Relevance: 1.6, Strings: 1, Instructions: 305COMMON

Download Yara Rule

Strings

dbq, xrefs: 04D98475

Memory Dump Source

Source File: 00000009.00000002.2036629585.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d90000_Dllhost.jbxd

Similarity

API ID:
String ID: dbq
API String ID: 0-1887291361
Opcode ID: 130830dc3c11521b95e977fb9a99a121e89cf0102c0436b93219efbe60574683
Instruction ID: e19e273b3586eac866655a6a738b80215e4e84d10ef13132e4ad824015113944
Opcode Fuzzy Hash: 130830dc3c11521b95e977fb9a99a121e89cf0102c0436b93219efbe60574683
Instruction Fuzzy Hash: E3E1E674A00218CFDB19EF75D884BA9BBB2FF89305F1044A9E409A73A4DB75AD85CF50

Function 04D976A9 Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

Te^q, xrefs: 04D977EA

Memory Dump Source

Source File: 00000009.00000002.2036629585.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d90000_Dllhost.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 6b916234b5431973bc6ad3ff6aaba6e72f258509b4a9e2fe2ff8966af1b88284
Instruction ID: fede2b6e02f7d7e2d26f19496661fdbf7869f119103e60e18a21d627c9a5e100
Opcode Fuzzy Hash: 6b916234b5431973bc6ad3ff6aaba6e72f258509b4a9e2fe2ff8966af1b88284
Instruction Fuzzy Hash: E651CD746405468FCB05FF79EA85E697BB1FBC830470086A5D005DB36DEBB0A949CF90

Function 04D976B0 Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

Te^q, xrefs: 04D977EA

Memory Dump Source

Source File: 00000009.00000002.2036629585.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d90000_Dllhost.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 1f00153713cbe545d73c013f2b0ad9733b5b77727640f28edbd72c0a487f13cb
Instruction ID: d9e9e5fc786869268d8b8b1f45e0c7183a21648f852f327e7217e5a5cc83a592
Opcode Fuzzy Hash: 1f00153713cbe545d73c013f2b0ad9733b5b77727640f28edbd72c0a487f13cb
Instruction Fuzzy Hash: 8E51CC746409468FCB06FF79EA85E697BB1FBC830470096A5D005DB36DDBB0A949CF90

Function 04D976B8 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

Te^q, xrefs: 04D977EA

Memory Dump Source

Source File: 00000009.00000002.2036629585.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d90000_Dllhost.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: b0deb9f0bc4b13ca870938684f1f14a771dc4cd3add181387ef1530dd7d28056
Instruction ID: acb4a125f5ca8d2e187c7e1fdef505ebbd67a144bc774c3911889d2d57f337a1
Opcode Fuzzy Hash: b0deb9f0bc4b13ca870938684f1f14a771dc4cd3add181387ef1530dd7d28056
Instruction Fuzzy Hash: 1D51BA746009468FCB06FF79EA85E697BB1FBC830470096A5D0049B36DEBB0A949CF90

Function 04D992B8 Relevance: .5, Instructions: 494COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2036629585.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d90000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57930ffe31369c932daf1bf9d68a7494f924e9c100663cd4e2bf2ca1ec8f50c4
Instruction ID: 34a0b99f0cb3435a1d26f2be76f18b11ce066afaa5a40c6c6f1e98c1479a349a
Opcode Fuzzy Hash: 57930ffe31369c932daf1bf9d68a7494f924e9c100663cd4e2bf2ca1ec8f50c4
Instruction Fuzzy Hash: 54E04FB2A092445FDF269BB094251B97BA89B52105F1149DE988AC7259E92A9F014382

Function 04D99285 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2036629585.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d90000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14af81e45b36b231831031c6c0587c01aaf5a854706bc428b6bcb9367727abd3
Instruction ID: 58b9ba0398c568e57a9f84362cf84ad4fa14954389a1d952dd0924163848ba0b
Opcode Fuzzy Hash: 14af81e45b36b231831031c6c0587c01aaf5a854706bc428b6bcb9367727abd3
Instruction Fuzzy Hash: F8E0EDB1A0E3485FCF22AFB094680AD7FE49F4211470109DED4CACB25AE8259E014392

Function 04D93E00 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2036629585.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d90000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb7db05a7e654706a21d0bae8a94b47a39900955bb9ce0a2ccc134f002a67fbd
Instruction ID: a935d58d6eed418db866b1a8e0df31443f1714823f9fab617acf6f9bc65d5910
Opcode Fuzzy Hash: bb7db05a7e654706a21d0bae8a94b47a39900955bb9ce0a2ccc134f002a67fbd
Instruction Fuzzy Hash: E1319074B102049FDB05BF78D814B7E3BEAEBC8700F0044A9D409E73A8DA359C49CBA1

Function 04D90890 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2036629585.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d90000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4625bc4cd349fa60475971f34335bc3c904a01c7cf3b4ab21c8830361f0b33a4
Instruction ID: 06c3c8a232be3f11a68f8272281aca85bc5cd8bd794b41db9eccc8d34c45746b
Opcode Fuzzy Hash: 4625bc4cd349fa60475971f34335bc3c904a01c7cf3b4ab21c8830361f0b33a4
Instruction Fuzzy Hash: 7B319FB1A003089FDB14EFB9D8486AEBFF5EF89324F248469D515E72A0C735A840CB94

Function 04D997D8 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2036629585.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d90000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77e4847051acab91f7c9d6f7aaca9898f8cdfa546aa51a02a9d69abedd742963
Instruction ID: 11ac84ab595728a5b0429c4346f1800d990b57f50414d4d4283c9651e961c1c7
Opcode Fuzzy Hash: 77e4847051acab91f7c9d6f7aaca9898f8cdfa546aa51a02a9d69abedd742963
Instruction Fuzzy Hash: D821B0B57046448FCB15AB7AA8A49297BF5FB8930031104EED109D7392DA30EC05CF62

Function 04D90994 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2036629585.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d90000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60f5d7fecdafb4cdb506341570eb75344ff63cd273081122d8f996e2b023b5e2
Instruction ID: f9b1418dc5aa3e1f03a1b13e60e8ae8b3165f1ee1c3e62e9ab86a3fa44251571
Opcode Fuzzy Hash: 60f5d7fecdafb4cdb506341570eb75344ff63cd273081122d8f996e2b023b5e2
Instruction Fuzzy Hash: A33100B0D01248DFDB24CFA9D584BDDBFF5AF49310F24802AE409BB264DB75A845CB94

Function 04D909A0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2036629585.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d90000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 995b5be40bdc47b59356ce0d91ff75b3b9444c52a1afbe333e3cc01403d5fa7e
Instruction ID: 2f37c940c1215ecab5df3d4786343be33066a0f7b3c329bd7c6264fdc739accf
Opcode Fuzzy Hash: 995b5be40bdc47b59356ce0d91ff75b3b9444c52a1afbe333e3cc01403d5fa7e
Instruction Fuzzy Hash: B231DEB0D01248DFDB14CFA9D584BCEBBF5AF48310F24802AE408BB264DB75A945CB94

Function 04D93CF8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2036629585.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d90000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cee9d2fad6ebae8b0287e95da2c6e2cd30ed1b6da41dddd24c6313dce1a6de36
Instruction ID: c3ea3cdadad2f5b1f6955f97eff794ee15f193bc56701cbb4efd9567483a8954
Opcode Fuzzy Hash: cee9d2fad6ebae8b0287e95da2c6e2cd30ed1b6da41dddd24c6313dce1a6de36
Instruction Fuzzy Hash: 57114F34A0020E9FCB00EBA9E9569BDBBB1EFC5300F105568D115B73A4DF70AA48CB91

Function 04D997C9 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2036629585.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d90000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ac062d8fca77f4b73c9d149a61db4a11882b161c843ebccd2c4c459addb3032
Instruction ID: 4619ed80338e82bc578ab583a13e59173f0a15d5005796e48d676d7077f974e4
Opcode Fuzzy Hash: 9ac062d8fca77f4b73c9d149a61db4a11882b161c843ebccd2c4c459addb3032
Instruction Fuzzy Hash: 63019EB5B002109F9F149F69E8E482A7BE5FF8961531149ADE109C7351DA30FC00CB61

Function 04D90DE0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2036629585.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d90000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94b4add9f4397b18e3d608cc3e8c0ebda5fbb527ee11837dcdb4ceb12f1685b6
Instruction ID: 1b955856eef110b23bf6b0de3ecd94f511540a16c993bf5b3485e1d75718843a
Opcode Fuzzy Hash: 94b4add9f4397b18e3d608cc3e8c0ebda5fbb527ee11837dcdb4ceb12f1685b6
Instruction Fuzzy Hash: 07117C712007409FC315EB3AE404AAA7BE6EB803147104A6DD059AF7A8DFB5ED49CFD1

Function 04D908F8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2036629585.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d90000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea99bdcbef88a4b61fa3fbe4894bcf9a2408df785a25b92bf83963f4d93bb70d
Instruction ID: 21b76919885ad82307de0432e20f17b004b58cf903fa790500b304e1a86a392d
Opcode Fuzzy Hash: ea99bdcbef88a4b61fa3fbe4894bcf9a2408df785a25b92bf83963f4d93bb70d
Instruction Fuzzy Hash: AF1152B18002498FDB20DFAAD484BDEBFF0EB49324F248419C859A3310C379A844CFA5

Function 04D90900 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2036629585.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d90000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42081cf7b22512f683df53c714d42c7f94665c8439988b45c811997756ad394c
Instruction ID: 9233b582a9eecde0268343f61c904e75c634c234f906ce2d2f72b53ff99e5762
Opcode Fuzzy Hash: 42081cf7b22512f683df53c714d42c7f94665c8439988b45c811997756ad394c
Instruction Fuzzy Hash: CB1130B1800308CFDB20DFAAD448BDEBBF4EB49320F208419D558A7310C339A940CFA5

Function 04D978FF Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2036629585.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d90000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edab3826d4207c04444315c51fdc76955b47fe1161d244c6c965a34b4b26174c
Instruction ID: 6316f3eae38e70c15af6d749709febba82e201f37004f8e7b22d2dd35a1c7470
Opcode Fuzzy Hash: edab3826d4207c04444315c51fdc76955b47fe1161d244c6c965a34b4b26174c
Instruction Fuzzy Hash: 44015634718215DFCB01AB68D650659BBE1AF8A310F01086DD48A8B354EA30EC418B86

Function 04D90EA0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2036629585.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d90000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6655da09e795a101e839c40ee6f5ccdff53f22423d151e1fb47a72eb0534ea15
Instruction ID: 1dad95b23623db7564e1c477175fae1ae5b14808b1e5b5b3677fc50df5183fe5
Opcode Fuzzy Hash: 6655da09e795a101e839c40ee6f5ccdff53f22423d151e1fb47a72eb0534ea15
Instruction Fuzzy Hash: 62F0A0716092008FC7166B79A8101A97BB6EAC125534449BAD089CE268EBA9DD4BD781

Function 04D996B0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2036629585.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d90000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72b8ee36bcd9abf33e1e0b3e9f8eea1979dbc34235ad95018f054bdea596e824
Instruction ID: 444e963f8ff3f4a57832e4744971957020b40ecece30774a56d8d818a114a877
Opcode Fuzzy Hash: 72b8ee36bcd9abf33e1e0b3e9f8eea1979dbc34235ad95018f054bdea596e824
Instruction Fuzzy Hash: 9AE08631A0B3804FCB165F7479180687FA4EF4712631500FEE85DC7752D93B8C028780

Function 04D99680 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2036629585.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d90000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 024e8a5281fc67c63278a5b6f0a91fd2cb8b41d309c21a81fc5fd49050d68ae2
Instruction ID: 36562f2ea5319ca2e915d3648512cebe6a5482b6fc68d5c0e1042375b343daeb
Opcode Fuzzy Hash: 024e8a5281fc67c63278a5b6f0a91fd2cb8b41d309c21a81fc5fd49050d68ae2
Instruction Fuzzy Hash: CDD0A7316402085BCF14EFF4481116EBAD9DB44101B10499D944EC7204ED35DE000792

Function 04D996C0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2036629585.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d90000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5125be5f262a9b5c37e3170536c8a7c462f613efba3db887e3d37595149ce02
Instruction ID: eb1d4597c3064f93c7f8283c01627f8cd76abf2b241634a936ca890cb111e214
Opcode Fuzzy Hash: b5125be5f262a9b5c37e3170536c8a7c462f613efba3db887e3d37595149ce02
Instruction Fuzzy Hash: 5DD012317023148BCF142B7AA90C06977D9EB8912332104FDE80EC3714DE7ACC0187C0

Function 04D90848 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2036629585.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d90000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 050f2f07d0b122c94ac78f8568a6664083c102faaf963eba371801dccae73e23
Instruction ID: 6dfd7ec7e827f0e471154f035cdfbbfa3ea7e7a75c7d00c47d33d8e815b0f78c
Opcode Fuzzy Hash: 050f2f07d0b122c94ac78f8568a6664083c102faaf963eba371801dccae73e23
Instruction Fuzzy Hash: F2D092B41446898ECB52FB29F945B167F69E790208F0005A0D0082B2BAD7A9A55CCBD5

Analysis Process: Dllhost.exePID: 6420, Parent PID: 2580COMMON

Executed Functions

Function 026A81A1 Relevance: 1.7, Strings: 1, Instructions: 474COMMON

Download Yara Rule

Strings

dbq, xrefs: 026A8485

Memory Dump Source

Source File: 0000000A.00000002.2121723265.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_26a0000_Dllhost.jbxd

Similarity

API ID:
String ID: dbq
API String ID: 0-1887291361
Opcode ID: b66c9c3075f1e31f7715dca8075a96670f3de94da4d5e1d78adab3187154c135
Instruction ID: 80e8b7240d33a62df4195c98352e1ded40df18aaf6a4eef549a3b933477dcb29
Opcode Fuzzy Hash: b66c9c3075f1e31f7715dca8075a96670f3de94da4d5e1d78adab3187154c135
Instruction Fuzzy Hash: 62220778A00218CFDB25EF24DD94BA9BBB2FB48304F1045E9E909A77A4DB719D81CF50

Function 026A7827 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

Te^q, xrefs: 026A796A

Memory Dump Source

Source File: 0000000A.00000002.2121723265.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_26a0000_Dllhost.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: b91577af4f28e6f647a2ace18df246c4c85b255bbb45e58c80bb2b6b06ecc08c
Instruction ID: 5dadada37fbb06ce300c537f1672478620831a7d04359e958b0fabdb117db7d9
Opcode Fuzzy Hash: b91577af4f28e6f647a2ace18df246c4c85b255bbb45e58c80bb2b6b06ecc08c
Instruction Fuzzy Hash: DB510138600645CFCB16FF68F981A9ABBB1FB84304B1186E5D0048B76DDBB1AD59CF90

Function 026A7838 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

Te^q, xrefs: 026A796A

Memory Dump Source

Source File: 0000000A.00000002.2121723265.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_26a0000_Dllhost.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 00edd41c015a60fa48dad4d39ee85399607a3402fa553966c7eb754255e9eb71
Instruction ID: 8e027fb4ee4954904df5508760998da6af942650762ae50b48abfc9e83e104ca
Opcode Fuzzy Hash: 00edd41c015a60fa48dad4d39ee85399607a3402fa553966c7eb754255e9eb71
Instruction Fuzzy Hash: C051D138600A45DFCB11FF68F981A5ABBB1FB4430471186E5D4048776DDBB1AD59CF90

Function 026A0DCF Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

4'^q, xrefs: 026A0DA8

Memory Dump Source

Source File: 0000000A.00000002.2121723265.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_26a0000_Dllhost.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: ec89fa0f29a709920866b2704f8a51f32dcae59d53af99d278038625d8edaa4b
Instruction ID: 04def136938b95b9b73a4f0150a4b02266948933d3ed0041864aabf9a4b28688
Opcode Fuzzy Hash: ec89fa0f29a709920866b2704f8a51f32dcae59d53af99d278038625d8edaa4b
Instruction Fuzzy Hash: 0931A1346047459FC716EF78E8106AEBBB2AF81304B0049A9D0499B7A5DFB1ED4ACF91

Function 026A92C8 Relevance: .5, Instructions: 496COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2121723265.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_26a0000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46e4afa436a99426ef7ea88ec5a126b3ce8c30d9697a8a2a52e856305c9ac30f
Instruction ID: 83c9be20b780bbeb5767886e8b24ea243127cd55d9cdc6742bfb3a3716bbfd62
Opcode Fuzzy Hash: 46e4afa436a99426ef7ea88ec5a126b3ce8c30d9697a8a2a52e856305c9ac30f
Instruction Fuzzy Hash: 24E06D7150A3845FDB26ABB498201B9BFF59F02204F1548EAD4C6C726AED299E148782

Function 026A6E20 Relevance: .5, Instructions: 494COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2121723265.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_26a0000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 587f9c5309e1231f0f4cd62cc4b73e4798c769b2aa2f5f24d309b830f3c8c88a
Instruction ID: 3f6e66799df46334a81335aebfc5cfa74c6599702be5dd6908351feacdf22526
Opcode Fuzzy Hash: 587f9c5309e1231f0f4cd62cc4b73e4798c769b2aa2f5f24d309b830f3c8c88a
Instruction Fuzzy Hash: BF02903D6609015FE672F720EEA3B0DB732EB90300F244991EA049B79DDBB4AC55CE59

Function 026A9295 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2121723265.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_26a0000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29712022bd50a108804ba2d59d1e8382158f54e680c950c34eb0e886abfd3667
Instruction ID: f017b2817df0eaf205612ad02e887ec3bbabce1a6b8d6b673e3fb66bb65eff9b
Opcode Fuzzy Hash: 29712022bd50a108804ba2d59d1e8382158f54e680c950c34eb0e886abfd3667
Instruction Fuzzy Hash: A3F0827060E3885FCB17ABB494245BD7FB0DE02214B154CDBD4C6CB26BDD248E0487A3

Function 026A3DF0 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2121723265.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_26a0000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f4cdfc3882dec1a5523cb27e0f01469aa835364c8d19fab9589d135282d0ebf
Instruction ID: 62ec0cde6a053e0c921d6428ad70de1f2dde280a91d3c4995bf193564f1d677b
Opcode Fuzzy Hash: 1f4cdfc3882dec1a5523cb27e0f01469aa835364c8d19fab9589d135282d0ebf
Instruction Fuzzy Hash: 8D41BD34B003059FDB15FBB8D81476E7BBAAB84700F0044A9E409E73A9EF759C56CBA1

Function 026A3E00 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2121723265.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_26a0000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f102abd1912fbc0a8812b2c44e776c68102665bb23cc2cec8d2f955d8e9c85
Instruction ID: 192fed508979bca0d7aa264bc09dcf3e6ac9cfeac3cf8f9b7bb528c02d7472ff
Opcode Fuzzy Hash: 35f102abd1912fbc0a8812b2c44e776c68102665bb23cc2cec8d2f955d8e9c85
Instruction Fuzzy Hash: 6431AD34B002059FDB15FB78D81476E7BBAAB84700F1044A9E409E73A8EF759C46CFA1

Function 026A97D9 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2121723265.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_26a0000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 675e13a920b1fab276b82fca4253f626e10b58767d17a100b9f45fff326dc0f5
Instruction ID: 8814e10bc02de0e81f353756f94868da0b084665806f684ca374c77c3afc8c9f
Opcode Fuzzy Hash: 675e13a920b1fab276b82fca4253f626e10b58767d17a100b9f45fff326dc0f5
Instruction Fuzzy Hash: 1B31C3302042419FC7159B79E9A0A69BBB2FF8532472449AAD055CB366CB30DD46CBB1

Function 026A97E8 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2121723265.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_26a0000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85f1e15e1ceed1ae2612f81de9c8706cad89d73acee7ee936ca24da46780a792
Instruction ID: 6203891ff063c6ba03ab7614438994006028e5b540fcbe9d7676c93885a6e78a
Opcode Fuzzy Hash: 85f1e15e1ceed1ae2612f81de9c8706cad89d73acee7ee936ca24da46780a792
Instruction Fuzzy Hash: 2431FF717052008FCB15ABB8A9A45697BB5EB8531432508AED016CB7A2CF30EC05CFB2

Function 026A0890 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2121723265.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_26a0000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c3ac735a06b4fd170d073d16c8ab8c0b036203d66c10e5b8a2e7e6a0fe24d45
Instruction ID: 39defbaa9e5068ff37c4c7c1f08ad3811f050508d8cf0cd4934c994eaceee61e
Opcode Fuzzy Hash: 3c3ac735a06b4fd170d073d16c8ab8c0b036203d66c10e5b8a2e7e6a0fe24d45
Instruction Fuzzy Hash: 25318BB19003489FDB14DFA9D85479EBFF5EF89324F108869D114A7260D735A940CFA5

Function 026A0994 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2121723265.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_26a0000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02ad34acd239806244477a9db266935caa6c35775cd98f9d00c5d2bf7f926d32
Instruction ID: 17c63a20b0458c77103b800291ff398c1d002dcca529686ae7694966d3ff7988
Opcode Fuzzy Hash: 02ad34acd239806244477a9db266935caa6c35775cd98f9d00c5d2bf7f926d32
Instruction Fuzzy Hash: 213131B0D01248DFDB24CFA8C194B8DBFF5AF49300F20806AE409AB265C775A944CF91

Function 026A09A0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2121723265.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_26a0000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19e315976210c5c2d4515805eb7f7b68a828a089dea734bfaad6ef4994673b7b
Instruction ID: e6e495ce231e7769c9b4e1d10d18ae84f34fae6942b05515edcf5d0a75c01cdb
Opcode Fuzzy Hash: 19e315976210c5c2d4515805eb7f7b68a828a089dea734bfaad6ef4994673b7b
Instruction Fuzzy Hash: 2A31EDB0D01248DFDB14CFA9D594B8EBBF5AF48310F20806AE409AB265CB75A945CF94

Function 026A3CE9 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2121723265.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_26a0000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13a2344c497a0f5fa09c2dbce81fe4edc765aa49060daf97412d7ba3b97d2e91
Instruction ID: 0f41c123143442644f4c83d807764113d6a2f4545b18deb27c1e1c92e130a76d
Opcode Fuzzy Hash: 13a2344c497a0f5fa09c2dbce81fe4edc765aa49060daf97412d7ba3b97d2e91
Instruction Fuzzy Hash: 7521603490020A9FCB05EFA8F8519ADBBB1EF85314F0145A9D101A73A5DF70AA9ADF71

Function 026A3CF8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2121723265.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_26a0000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7819043b79c94be59b1cf36df779cd1f0a23d09fc8556abd0e00f5ba059f0dd
Instruction ID: ebf67d027ecc7c6c406a18fca7558d4afb55236792bcf503272d94934f4a4e78
Opcode Fuzzy Hash: a7819043b79c94be59b1cf36df779cd1f0a23d09fc8556abd0e00f5ba059f0dd
Instruction Fuzzy Hash: 5311363490020A9FCB05FFA8F8555ADBBB6EF84314F004568D115A73A5DF70AA99CF71

Function 026A08F8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2121723265.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_26a0000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 317364f167e70e8ed3ff0d8d7b2e20d00480ace70114c51baa25a80bcfb1167e
Instruction ID: 968555d30e5ae126bb97d42a6b4adca6597f6ff5aa42262de624477fafceca69
Opcode Fuzzy Hash: 317364f167e70e8ed3ff0d8d7b2e20d00480ace70114c51baa25a80bcfb1167e
Instruction Fuzzy Hash: 3D1110B59003898FDB20DFAAC548B9EBFF4EB49324F208459D459A7610D379A944CFA1

Function 026A3FF4 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2121723265.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_26a0000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39e5c497e30765070ef90e0db19897e416b4e0219b07c8edb1d0aabeffc4f551
Instruction ID: 247f5252569798edc8789ed890b01f111fb7dcfbbe83c0b436e06c730b4ca3f4
Opcode Fuzzy Hash: 39e5c497e30765070ef90e0db19897e416b4e0219b07c8edb1d0aabeffc4f551
Instruction Fuzzy Hash: 84113FB19002488FCB20DF9DC448B9EBFF4EB09324F208469E858A7250C339A944CFA4

Function 026A0DE0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2121723265.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_26a0000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 440a9fbf10eb1056282d93439529966c56e8e08f342edfce942322c835014dff
Instruction ID: 5a1641fc49086d035410f4b3b8bdd362a2fef6262befab5809f2213b9cbb135e
Opcode Fuzzy Hash: 440a9fbf10eb1056282d93439529966c56e8e08f342edfce942322c835014dff
Instruction Fuzzy Hash: 99117C312007009FC365EF29E4146AA7BE6AB81314710496DD0198F7A8DFB2ED8ACFE1

Function 026A7609 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2121723265.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_26a0000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 070cfeb012739875f2de26428d34e275e3a53c68fce75b4c68f8ed67bf3b3486
Instruction ID: 4d0afe1d2bfa0d17e2c94b4cde0779a00b365ea4f082df0cf1049bf5a17ba525
Opcode Fuzzy Hash: 070cfeb012739875f2de26428d34e275e3a53c68fce75b4c68f8ed67bf3b3486
Instruction Fuzzy Hash: 661143B1900248CFCB20CF99C444BDEBFF0EB49324F208459E458A7250C734A944CFA0

Function 026A0900 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2121723265.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_26a0000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bacb3aa6b20d8ccf494ebb943be331998009947229fa3e3d3dd64ad1127c37f
Instruction ID: c2143c2a54c4a5822966cc0926dfdc1169ac0338b8182d140ffd18726f709543
Opcode Fuzzy Hash: 7bacb3aa6b20d8ccf494ebb943be331998009947229fa3e3d3dd64ad1127c37f
Instruction Fuzzy Hash: 111100B59002498FDB20DFAAC544BDEBBF4EB48324F208459D459A7350C379A984CFA5

Function 026A76A8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2121723265.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_26a0000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b338546fdf4bfd3a25c7fa4dce1b50104c8bed3564a8829df0299fb86ebffe95
Instruction ID: b81268d57680b469d4a9d432ea9d66a982bcd8866864a93d1cdf7213abeffadc
Opcode Fuzzy Hash: b338546fdf4bfd3a25c7fa4dce1b50104c8bed3564a8829df0299fb86ebffe95
Instruction Fuzzy Hash: 0F015A347092519FDB02EB3CE62462EBBE1AF8A310F0148A9D0C58B364DB34AD11CB96

Function 026A96F8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2121723265.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_26a0000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57176a05c516c4b2aa205f6206f29de93f1296876ab44ca0823d1dbd58887ccc
Instruction ID: 4d56653d82bda952bbc27b556ee955fbc70a77a09056921f01eb2581b9f0240f
Opcode Fuzzy Hash: 57176a05c516c4b2aa205f6206f29de93f1296876ab44ca0823d1dbd58887ccc
Instruction Fuzzy Hash: 33F082313021114FD7517B7CB8241A9BB91EF8632472000ADE905CB359DE34CD454B90

Function 026A0EA0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2121723265.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_26a0000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 078f430e34381a0c219cec45ed317bfe6b26de7df010aa04ec918c6336816c4d
Instruction ID: e183bad4c5605352659477693f260f70b620553d868c08e05f9418fc21f49ace
Opcode Fuzzy Hash: 078f430e34381a0c219cec45ed317bfe6b26de7df010aa04ec918c6336816c4d
Instruction Fuzzy Hash: 23F055356093408FC3199F38A8202A93BB2EB8124430009FAD009CF768EBA4CC47CB91

Function 026A96C0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2121723265.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_26a0000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d631a233361480a5cecc75f7c0f8b52da0e8aebf26c59f1fde65a12afb87fed4
Instruction ID: 17a7b7bcb1811826d6078ddffc95ebd5a3fea651d61d5c7f8507f9b4cea6123e
Opcode Fuzzy Hash: d631a233361480a5cecc75f7c0f8b52da0e8aebf26c59f1fde65a12afb87fed4
Instruction Fuzzy Hash: DFE06531A1A2404BCB156B74653807C7FA0DF4722131814EEE445C7751D93ACD118741

Function 026A0839 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2121723265.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_26a0000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2afb70e2717d38b2f5d537ae66ddc73a692ba9be18d16169803c344fbdf040bb
Instruction ID: 111ddb007410a176dbf2ea7f39dd7f98c9e0e64bd3bd77b0a52dbc6070d22d8b
Opcode Fuzzy Hash: 2afb70e2717d38b2f5d537ae66ddc73a692ba9be18d16169803c344fbdf040bb
Instruction Fuzzy Hash: B3E01A341487C58ED753A728B804B003F75A763204F0546D2E4448B67BD7A9555EC7A2

Function 026A9690 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2121723265.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_26a0000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16f1a43794a94081c34e9d0be6fd6226adf9cd7bb0fb566ba961cba3f69a3f61
Instruction ID: d194da7b2f8dd17161eeaef2ce6561bce612fa6878715996d779671a203b3993
Opcode Fuzzy Hash: 16f1a43794a94081c34e9d0be6fd6226adf9cd7bb0fb566ba961cba3f69a3f61
Instruction Fuzzy Hash: F7D0A7716402095BCB14FFF4481017EBAE9DB45200B10499D944AC7304ED35DE000792

Function 026A96D0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2121723265.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_26a0000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b041e8e0c535a15c7ba0ab61dc39eb06d49be450a8aa4b80bdbfec310d0d1701
Instruction ID: f151c2c7697322118ebd5f32e46a86ccae31b5979dbcee0fb792c4d3df3e052c
Opcode Fuzzy Hash: b041e8e0c535a15c7ba0ab61dc39eb06d49be450a8aa4b80bdbfec310d0d1701
Instruction Fuzzy Hash: 08D012317123148BCB153B79A82C4B977D9EB8A72232004FDE406C3700DE7ACC0187C0

Function 026A0848 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2121723265.00000000026A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_26a0000_Dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94965678994d03e2a6368ba86c3fcf9187e9251519c014313c92843e14aa81b1
Instruction ID: 474ab4f0080a7160a6ce4d677b61851c2039f2801648a33a75a033cf5c10ee8d
Opcode Fuzzy Hash: 94965678994d03e2a6368ba86c3fcf9187e9251519c014313c92843e14aa81b1
Instruction Fuzzy Hash: D4D09E341447468EDA61FB18F9457057F65A760208F000591E4044B73AE7E5555ACBE5

Analysis Process: Java update.exePID: 4076, Parent PID: 2580COMMON

Executed Functions

Function 01718DA8 Relevance: 2.6, Strings: 2, Instructions: 105COMMON

Download Yara Rule

Strings

Hbq, xrefs: 01718E75
Hbq, xrefs: 01718E16

Memory Dump Source

Source File: 0000000B.00000002.2211883596.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1710000_Java update.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: aeb68ff8d75247b2badd25bd11eb082813e32cf90b8d8ce7e91472c13eef28f9
Instruction ID: 92cb3fc65b0a87a21e686d5bfd6413936852715f17e811562c70d81ac299a156
Opcode Fuzzy Hash: aeb68ff8d75247b2badd25bd11eb082813e32cf90b8d8ce7e91472c13eef28f9
Instruction Fuzzy Hash: 8A319030B002058FCB58AA7C885466FB9A7BBD8354B288629D519DB3C8DF35DD0A87D6

Function 017180A0 Relevance: 1.7, Strings: 1, Instructions: 466COMMON

Download Yara Rule

Strings

dbq, xrefs: 01718385

Memory Dump Source

Source File: 0000000B.00000002.2211883596.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1710000_Java update.jbxd

Similarity

API ID:
String ID: dbq
API String ID: 0-1887291361
Opcode ID: 06d85b6155908e4b96ee8cc927bfc8a253f81edb13cf87b74ec1427045889ecb
Instruction ID: ab2d174a29a839fe77519be7c17c5ba83a3971730fcde5c2fb1918f1028915b4
Opcode Fuzzy Hash: 06d85b6155908e4b96ee8cc927bfc8a253f81edb13cf87b74ec1427045889ecb
Instruction Fuzzy Hash: F9222B74A00218CFDB24DF35D994BADBBB2FB48300F1085A9E919AB3A4DB759D81CF51

Function 017176A8 Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

Te^q, xrefs: 017177EA

Memory Dump Source

Source File: 0000000B.00000002.2211883596.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1710000_Java update.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 1a4b5a249e646af2814c9e4117661e433ac8e936fb44a60f084c0f52e7a4ef51
Instruction ID: 899a35ce601b668330926edad812b5c4c683f89bab47be8104fa72e4351e0a0f
Opcode Fuzzy Hash: 1a4b5a249e646af2814c9e4117661e433ac8e936fb44a60f084c0f52e7a4ef51
Instruction Fuzzy Hash: 3151F07061024ACFCB05DF6EEA84949BFB3FB45304B108666D4158736ADB78ED8ACF91

Function 017176B8 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

Te^q, xrefs: 017177EA

Memory Dump Source

Source File: 0000000B.00000002.2211883596.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1710000_Java update.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 511a61b202ca4b4f9758dbdbb7d0dfae54e55ee5b15bc5b749f7422f96ef1bd1
Instruction ID: 2d49c36d0cbb9463e95c79a5dd495c47ad8dc0dd63b32958f2081154721fa032
Opcode Fuzzy Hash: 511a61b202ca4b4f9758dbdbb7d0dfae54e55ee5b15bc5b749f7422f96ef1bd1
Instruction Fuzzy Hash: C151EF7065024ACFCB05DF6AFA84949BFB3FB44304B108666D4158736ADB78ED8ACF91

Function 01710DCF Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

4'^q, xrefs: 01710DA8

Memory Dump Source

Source File: 0000000B.00000002.2211883596.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1710000_Java update.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: c38a33c131f7949a871826d5c2a04f18a9ddc270a0ec6bd74dfb7edb9b7a08cf
Instruction ID: 951b734c5424cc453af1ff4d96d723ce034c0ea923ed0c5e4c207035187f1333
Opcode Fuzzy Hash: c38a33c131f7949a871826d5c2a04f18a9ddc270a0ec6bd74dfb7edb9b7a08cf
Instruction Fuzzy Hash: 79319C30600209DFC715EF39E410A9EBBB6FF82314B008969D4169F3A8DB75ED89CB91

Function 017192C0 Relevance: .5, Instructions: 496COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2211883596.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1710000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1818a94404aa9047c419eb7eb809c3a1ec0f2288f16fe274dba193fda38648f
Instruction ID: c6aeb5532191f14ae4c54ec10bf77f4f4ab6147ff3817e8fb8fa430c38749303
Opcode Fuzzy Hash: c1818a94404aa9047c419eb7eb809c3a1ec0f2288f16fe274dba193fda38648f
Instruction Fuzzy Hash: 79E0D8B1D093844FC72697B849311BDBFB09F52209B050DEB9886C7159E9295E059353

Function 0171928D Relevance: .5, Instructions: 494COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2211883596.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1710000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 453893f362aae14dcaf1b37cb60ae5b37e09a63a8c89cfd38a3752a598854fd0
Instruction ID: bc64374bf691df369b4df36381eb22bc0df8262bd7c30eaa1c8256f6481eda16
Opcode Fuzzy Hash: 453893f362aae14dcaf1b37cb60ae5b37e09a63a8c89cfd38a3752a598854fd0
Instruction Fuzzy Hash: DF016871A043004FCB06ABBC993516DBFA5EF8620870148AAD605CB35EFE618E0283A2

Function 01713DF0 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2211883596.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1710000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30e4f07d9e8c09bc8d64a414ed8c7d461e432dba67c947870e810ea0ea78ece
Instruction ID: fa7df018518198e73dcdccc726f9c505453939091c4aaf4491ba4882e8c80bd4
Opcode Fuzzy Hash: d30e4f07d9e8c09bc8d64a414ed8c7d461e432dba67c947870e810ea0ea78ece
Instruction Fuzzy Hash: 0E419F30B00205DFDB15AB79D51476E7BBAEB88710F1044A9E409D73A8DB39DD8ACB92

Function 01713E00 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2211883596.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1710000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b086aa85a41bfa9742dffa7ec4577bbdeb095c3538acf3482491b5080445dd0
Instruction ID: 6be23dffafbaf556456f4d374d784e74bd194862c0b32c16d1a558d8ee5c1557
Opcode Fuzzy Hash: 3b086aa85a41bfa9742dffa7ec4577bbdeb095c3538acf3482491b5080445dd0
Instruction Fuzzy Hash: 82319C30B00215DFDB15AB79D91476E7BBAEB88710F104468E409E7398DB39DD86CB92

Function 01710890 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2211883596.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1710000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b22bae7a45b74ea602c1c7016f5d630a2ab399f23a21e0e5158aa12a8ab2596
Instruction ID: 344fcf9ad9ae3d1bdf209c5e0e0d2fe73e453e7e5d67a5485892c01c71deac6d
Opcode Fuzzy Hash: 3b22bae7a45b74ea602c1c7016f5d630a2ab399f23a21e0e5158aa12a8ab2596
Instruction Fuzzy Hash: 70316BB19003099FDB14EFA9C845A9EBFF5FF49320F208869E515A7264D735A980CB91

Function 017197E0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2211883596.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1710000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aab46a64c30bdf29759277926cffe3a52ed6ca129123c5fc4afc51411e008c2
Instruction ID: 71bff96b4d935d71837911ec460327be81e7cd4aed02cd4fb87b7c9cbb7c8d21
Opcode Fuzzy Hash: 6aab46a64c30bdf29759277926cffe3a52ed6ca129123c5fc4afc51411e008c2
Instruction Fuzzy Hash: E221F171744200CFC715DBBCE8A4529BBF9FB8921871504A9EA19CB395CA34EC06C7B2

Function 01710994 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2211883596.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1710000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 794249012ecfe615100373cbf156fca2430ef4262e0f6ec24209d7be2987336d
Instruction ID: 4fbb71a9577a5b3e05ffb1d92af3ea4b7aa07b50d993e4643c30f4b40ad175a5
Opcode Fuzzy Hash: 794249012ecfe615100373cbf156fca2430ef4262e0f6ec24209d7be2987336d
Instruction Fuzzy Hash: 83310EB1D01248DFDB14CFA9C584BDEBFF5AF49310F24816AE408BB264CB75A985CB94

Function 017109A0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2211883596.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1710000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bf947259d0905ed72fb84dde5da521a9b4c71e171cc7487798848b12968e4f8
Instruction ID: 053840ec0743b0f848d789e2d63087126bdd908fa869e5deac4688a8ed3b6729
Opcode Fuzzy Hash: 8bf947259d0905ed72fb84dde5da521a9b4c71e171cc7487798848b12968e4f8
Instruction Fuzzy Hash: E831EFB1D01248DFDB14CFA9D584BCEBFF5AF48310F24816AE409BB264CB75A985CB94

Function 017196B8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2211883596.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1710000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 720db1657095827c942555ccd5f3ee5826da7879437991c0cac4bf822f64d8fb
Instruction ID: 9f97b34048691b4a0c16af53212dc134229576029908042225ef13d48a467c4f
Opcode Fuzzy Hash: 720db1657095827c942555ccd5f3ee5826da7879437991c0cac4bf822f64d8fb
Instruction Fuzzy Hash: 8611E1316043404FC719AB79E95465ABFA2EF86315B1488A9D055CF366DE34DC0A9790

Function 01713CE9 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2211883596.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1710000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ed4909144fe5823f00ea6525df9ea0b76d7bc72ef15c0a3acdfdbfeef11df60
Instruction ID: d510ce38ddf656dfe148fe62de94fa7f5ee0880808c42af42e23226c541ba66e
Opcode Fuzzy Hash: 0ed4909144fe5823f00ea6525df9ea0b76d7bc72ef15c0a3acdfdbfeef11df60
Instruction Fuzzy Hash: 9B215430D0020ADFCB01EBA8E4554ADBB76FF85314F404A69E515A73A4DB34AD88CB65

Function 017197D1 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2211883596.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1710000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe117890abed2c871d874f99a81a7e4720bf554aa0b05c01db685e3f5fd671cc
Instruction ID: 393c435477ca554618273a7b12e6a7da5797c03ca661047a3968901c7b2634b5
Opcode Fuzzy Hash: fe117890abed2c871d874f99a81a7e4720bf554aa0b05c01db685e3f5fd671cc
Instruction Fuzzy Hash: 430192B5B44210EFD714DFACE9A4829BFB8FF4962931104AAEA19C7355CA70EC06C771

Function 01713CF8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2211883596.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1710000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a7d47a2733274b19de724c407bf3c33a7d0fa69dc85a31851cb8d41303161a1
Instruction ID: e3426cbd1f65bbac0ae4feb972d784efc5b550ed5d06cabf0d9bd717775e26bc
Opcode Fuzzy Hash: 4a7d47a2733274b19de724c407bf3c33a7d0fa69dc85a31851cb8d41303161a1
Instruction Fuzzy Hash: 5C112130D0011AEFCB00EBA8E8555ADBB76FF84304F404A68E516B7354DB34AD88CBA5

Function 01710DE0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2211883596.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1710000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4ff9997ce0d4b8f6002a82c0bd635b1a510da4bc1f1593139541d15087264d7
Instruction ID: 468af9658962a048f530933101bb9ba374993d0238f3db1c34691fe773950989
Opcode Fuzzy Hash: a4ff9997ce0d4b8f6002a82c0bd635b1a510da4bc1f1593139541d15087264d7
Instruction Fuzzy Hash: CB119E312003049FC315EB29940469ABBAAFB81314B008D39D01A4B3A8DFB5ED89CBD5

Function 01717901 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2211883596.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1710000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd52dff0142366ad4ae58543e41e55e6c3ca05327bf7c5f904da84c8cfba8817
Instruction ID: 9b658f027cffefb25fe079bfe42d80ac31eb8f7f7e4614e098c8703276b56f4b
Opcode Fuzzy Hash: cd52dff0142366ad4ae58543e41e55e6c3ca05327bf7c5f904da84c8cfba8817
Instruction Fuzzy Hash: A6017570A083568FCB06EB3CD55461DBBF2AF8A311F41486AE4C5CB365DB349D448B82

Function 017108F8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2211883596.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1710000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c7d1b2f34d6f7e722c54451659386b34c83b7bed9466143062af665a5fb54ec
Instruction ID: cb23955759182a2625ee529a5d30e46919b845bdadf83ef38ac193e8a277a413
Opcode Fuzzy Hash: 4c7d1b2f34d6f7e722c54451659386b34c83b7bed9466143062af665a5fb54ec
Instruction Fuzzy Hash: F91113B18006498FDB20DFAAC444B9EFBF4EB48324F208459D459A7310C335A980CFA1

Function 01710900 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2211883596.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1710000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 593f98a80efdc3f79cc817741850eb5f3ccb8d45063e33324747f48c303c4271
Instruction ID: e43680a077b2c288d34c5e72bb6cd671a4cf9374a45481e4178eaf6f2e319165
Opcode Fuzzy Hash: 593f98a80efdc3f79cc817741850eb5f3ccb8d45063e33324747f48c303c4271
Instruction Fuzzy Hash: 061130B18002488FDB20DFAAC488BDEFFF4EB48324F20841AD459A7210C335A980CFA1

Function 01710EA0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2211883596.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1710000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d35748a188cf8e6b7a59a93e05b10b9dfcecaa0d836ebef8a5beeab768da457
Instruction ID: feaadb00c738583b10de18899210c8f780c4a1b1938d85631a735ad0cb187799
Opcode Fuzzy Hash: 6d35748a188cf8e6b7a59a93e05b10b9dfcecaa0d836ebef8a5beeab768da457
Instruction Fuzzy Hash: D4F05572A042008FC3065B3DA8100A9BFB6FAC224030449BAE01ACF268DB68CD8BC391

Function 01710839 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2211883596.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1710000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3f3c4e38a21cc9a967cd9aefc7262837066ab05acafe6928e0dcf4a354dd450
Instruction ID: 92d630818f554b5db103cbc0dea9d042cba7b3dd88d043b9c99a614d9144ba45
Opcode Fuzzy Hash: f3f3c4e38a21cc9a967cd9aefc7262837066ab05acafe6928e0dcf4a354dd450
Instruction Fuzzy Hash: 81E04F30008389CFCB12DB68E941B017F78EB13304F0205E5D444AF22BC7B8AA88CBE5

Function 01719688 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2211883596.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1710000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3052d64cf38438e6839eb130656a35fba94c47288ffacf83f597d7fd9399556a
Instruction ID: 3fdce9d61df5dc8edfe32301eaadd604d8b3628c037a2f4689df584786842019
Opcode Fuzzy Hash: 3052d64cf38438e6839eb130656a35fba94c47288ffacf83f597d7fd9399556a
Instruction Fuzzy Hash: E8D0A731A003085BCB18EFB4481106E7BE9DB44210740896DA80AC7204EE75AE005792

Function 01710848 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2211883596.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1710000_Java update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e8e8a3c857035daea4179e9184ae3c3d845ec7ab48db9b51d8a9ef3e5f52918
Instruction ID: e9bf7d0fdef722949356046070a37a0cdb999c135fad77af3d7b33529dcb159f
Opcode Fuzzy Hash: 3e8e8a3c857035daea4179e9184ae3c3d845ec7ab48db9b51d8a9ef3e5f52918
Instruction Fuzzy Hash: F4D0C930144289CECB22EB2DFA45705BF6DE761309F0101A0D4081B32AD7B9EA98CBD9

Analysis Process: Server.exePID: 2044, Parent PID: 1044COMMON

Executed Functions

Function 02828E08 Relevance: 2.6, Strings: 2, Instructions: 105COMMON

Download Yara Rule

Strings

Hbq, xrefs: 02828ED5
Hbq, xrefs: 02828E76

Memory Dump Source

Source File: 0000000C.00000002.2383686655.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2820000_Server.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: 9e73260838a1b292447970aacfce3ae2056697a3ef107a178c8d74723994fddb
Instruction ID: 13ed1f36c88d6f750773346786e5cdbcc6c787518b7d0e9d308a70854aa7dcf2
Opcode Fuzzy Hash: 9e73260838a1b292447970aacfce3ae2056697a3ef107a178c8d74723994fddb
Instruction Fuzzy Hash: EB31B238B002244FCB58AE7C991066F2AA7ABC4354B248528E51DDB7D4EF34DD4687F2

Function 028281A1 Relevance: 1.7, Strings: 1, Instructions: 477COMMON

Download Yara Rule

Strings

dbq, xrefs: 02828485

Memory Dump Source

Source File: 0000000C.00000002.2383686655.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2820000_Server.jbxd

Similarity

API ID:
String ID: dbq
API String ID: 0-1887291361
Opcode ID: 48626e8be5fdf3d9d42c7d7c92c9b7146ae45031501f61cbe13f1a9baa31a73e
Instruction ID: a96a44742c2cdbd19c005a8d1a1006a13427c6894efdf64fe033d660a4b51594
Opcode Fuzzy Hash: 48626e8be5fdf3d9d42c7d7c92c9b7146ae45031501f61cbe13f1a9baa31a73e
Instruction Fuzzy Hash: DF221978A04218CFDB15EF34D994BA977B2FF48304F1046A9E909AB3A4DB319D85CF91

Function 02827827 Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

Te^q, xrefs: 0282796A

Memory Dump Source

Source File: 0000000C.00000002.2383686655.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2820000_Server.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: cf7a11111ae4b90f4e78b5467a7d6eda0701d062979fed1619e80d18c08ee967
Instruction ID: 70233d5e114bef94bc400750c0c6f1a7536d5ba60ac9a1793f192a8371ef7a85
Opcode Fuzzy Hash: cf7a11111ae4b90f4e78b5467a7d6eda0701d062979fed1619e80d18c08ee967
Instruction Fuzzy Hash: 5151FC746586498FCB06EF6CE985989BBA2FF44304B00A765D4088F36DEB70A949CFD0

Function 02827838 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

Te^q, xrefs: 0282796A

Memory Dump Source

Source File: 0000000C.00000002.2383686655.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2820000_Server.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 5bc2b63e1a50f96c34eef3187e69c544f443d44cfc18eecdd8fe6e85523ba0b9
Instruction ID: b2eb1a29919e576b3e9628ef2d8640face276eec05141d715116c6d2f783f070
Opcode Fuzzy Hash: 5bc2b63e1a50f96c34eef3187e69c544f443d44cfc18eecdd8fe6e85523ba0b9
Instruction Fuzzy Hash: 6C51BB74648A498FCB06EF6CE985949BBA2FF44304B10A765D4088F36DEB70A949CFD0

Function 02820DCF Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

4'^q, xrefs: 02820DA8

Memory Dump Source

Source File: 0000000C.00000002.2383686655.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2820000_Server.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: b693a5382b78ebc78096b4c577478c48c694817660baabfddfb5c4b281251570
Instruction ID: 05adcea2c52795fcd8af62098573a6e8c5dfedf496b25e2bca3018420d606864
Opcode Fuzzy Hash: b693a5382b78ebc78096b4c577478c48c694817660baabfddfb5c4b281251570
Instruction Fuzzy Hash: 1E31B0346047459FC705EF38D8446AE7BA2EF81304B008A69D0499F3A9DFB1EC8E8BD1

Function 02829219 Relevance: .5, Instructions: 509COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2383686655.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2820000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c6c3142d1c27d16558841bb1ee78ffbef8619ab525115819794a6f2762e98c4
Instruction ID: 090851d07af692ba7741d6e463fa88f64e4dfb38d725f0f233cb677c8d99501a
Opcode Fuzzy Hash: 6c6c3142d1c27d16558841bb1ee78ffbef8619ab525115819794a6f2762e98c4
Instruction Fuzzy Hash: B9E0DF716452484FDB12EFB094952ADBBE4EE42100B048AFAC44ACB552E9249E0B8B52

Function 02826E20 Relevance: .5, Instructions: 494COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2383686655.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2820000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 415311e810a1e284557ad872894aa171a535205ecd149b088c13c44021aca086
Instruction ID: 3f8809ca50a9664abe9a2fbbb3a4af8a8d9375579f8ef5e2b02bf09aed4b616e
Opcode Fuzzy Hash: 415311e810a1e284557ad872894aa171a535205ecd149b088c13c44021aca086
Instruction Fuzzy Hash: F6026A3D7589206BE661F724EE93B09B722FF91300F548B51D6049E3DCCB74A8898ED6

Function 02823DF0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2383686655.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2820000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0726e64b9a6e9ac1e33c1abead0308a4fd1538e4ee5c456a33912ffe2a17f471
Instruction ID: 3a5cb74d0aa8530476f051d2a7b79c88de5357b97b2d27b7781d50829e1c1149
Opcode Fuzzy Hash: 0726e64b9a6e9ac1e33c1abead0308a4fd1538e4ee5c456a33912ffe2a17f471
Instruction Fuzzy Hash: 5241D234B043149FDB05FB78D85576E7BAAAF85700F108569E009D73A8DF358C8A8BE1

Function 02823E00 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2383686655.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2820000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acf79c021e8ecbb841db98d04ce8ab9ce6f41ed1bf07f8faf0f3f4979c131552
Instruction ID: aa1b501adc33c6ef6dac80a9aa07139682d38cf6a317d062a12ed40eae7312a1
Opcode Fuzzy Hash: acf79c021e8ecbb841db98d04ce8ab9ce6f41ed1bf07f8faf0f3f4979c131552
Instruction Fuzzy Hash: BD31A034B002149FDB05FB78D85576F7BAAAF85700F108569E009D73A8DF399C898BE1

Function 02829748 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2383686655.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2820000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69225af0f338a68bf8806324a757556a93ee01416f0cbf26cfff143683663cee
Instruction ID: 8c8b31e02c27e26c94bf4d3a8ada8f65c6e61d1fbad582cc664786cc191b2275
Opcode Fuzzy Hash: 69225af0f338a68bf8806324a757556a93ee01416f0cbf26cfff143683663cee
Instruction Fuzzy Hash: 2731D2797083608FC705AF78E89486A7BB5FF8520572549A9D409CB3A5DF20EC49CBB2

Function 02820890 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2383686655.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2820000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42e66715b792d3bfab1ef0b962d007db019e7af3de9b99bc2f8dcc2667bcc6ff
Instruction ID: 3d98f87635d4aff3390643d731780dc2a0357e3c6c0a917477cb123c700738b5
Opcode Fuzzy Hash: 42e66715b792d3bfab1ef0b962d007db019e7af3de9b99bc2f8dcc2667bcc6ff
Instruction Fuzzy Hash: 5F31ABB99003289FDB14DFB9C844B9FBFF5AF88324F10846AD159E72A1D735A484CB90

Function 02820994 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2383686655.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2820000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 639b1f1d41956ebaa813bbc02c618e77d5c95c8e46d1a3b7f91b965141188a1b
Instruction ID: fe261eca0bab2f3923eb146ae27bfa8bce3f1e0d03ad41c2add8bbb956ef1203
Opcode Fuzzy Hash: 639b1f1d41956ebaa813bbc02c618e77d5c95c8e46d1a3b7f91b965141188a1b
Instruction Fuzzy Hash: A23100B4D012589FDB14CFE9D584BDDBFF1AF48304F24806AE449BB264CB75A889CB94

Function 028209A0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2383686655.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2820000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a54037a47008e98dbf90343c8f63ae843cc6e7b4202a8bc980ae9d6db0ed91ed
Instruction ID: 798a78bfc52cc55f6b51afe0289becff3a7dc5877eab4fc567f723964dfba154
Opcode Fuzzy Hash: a54037a47008e98dbf90343c8f63ae843cc6e7b4202a8bc980ae9d6db0ed91ed
Instruction Fuzzy Hash: 3431EFB4D01218DFDB14CF99D584B8DBBF5AF48310F24802AE409BB264CB75A989CB94

Function 02823CE9 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2383686655.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2820000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 085e2a8987794150dbf6909912b736bd45ad908b2f5d9dc3f94f45a0fb434380
Instruction ID: 03676a7e8f7a2391f14d2bca0be672d828e992e11e4b005ed7b653c54e8e497c
Opcode Fuzzy Hash: 085e2a8987794150dbf6909912b736bd45ad908b2f5d9dc3f94f45a0fb434380
Instruction Fuzzy Hash: E621B67494020A9FCB01EF68E8954ADBB71EF81304F004669D109E73A5EF70AA89DBB1

Function 02829738 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2383686655.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2820000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1afa0bdefcbdc235c543508979d6b83d7fa5540edaf2c439cf1b2f7a4611637
Instruction ID: 1997daf6602603a1390465caae429d237bee44280925550ea6324ef9adf5b728
Opcode Fuzzy Hash: b1afa0bdefcbdc235c543508979d6b83d7fa5540edaf2c439cf1b2f7a4611637
Instruction Fuzzy Hash: A20196BD7042209FC7149F64E8D48697BB4FF8921572549AAD419C7392DB30EC49CBA1

Function 02823CF8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2383686655.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2820000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a78a995e452448285602e12120f8e62f6f8e8ee1518c27ac589576b71b8148e
Instruction ID: 33eddf15ba3dd38be3babb1e85dddc3af8226e07921da5e796833ca325b9e830
Opcode Fuzzy Hash: 4a78a995e452448285602e12120f8e62f6f8e8ee1518c27ac589576b71b8148e
Instruction Fuzzy Hash: 47113A3494020A9FCB05EFACE85559DBB76EF84304F004529D109E7395EF70AA49DFB1

Function 02827609 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2383686655.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2820000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8ca386804cad7d82f9268f92345e3724f47b8b23860d4344475d2e026d6c92d
Instruction ID: 216430607870edcadd85e8b1ffb50c9c3f38b71abc5da4e893af8efcef5e372f
Opcode Fuzzy Hash: a8ca386804cad7d82f9268f92345e3724f47b8b23860d4344475d2e026d6c92d
Instruction Fuzzy Hash: 751155B5800218CFDB20CF99C848BDEFFF0EB48320F208419E458A7250C335A948CFA4

Function 02823FF4 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2383686655.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2820000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b61e2e4a797cf5de66240c9fae5f76855eed8ee071d2df68cb8b8e0185c68c9a
Instruction ID: 3630b5d991eee294ab5bd4de7ef831d614ecd47999581e7344c48b1a8b015a23
Opcode Fuzzy Hash: b61e2e4a797cf5de66240c9fae5f76855eed8ee071d2df68cb8b8e0185c68c9a
Instruction Fuzzy Hash: AF1132B99002189FCB20DF9AC448B9EBFF4EB48320F108419E459A7251C375A988CFA4

Function 02820DE0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2383686655.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2820000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 029115c63d01b8931fc3f8d786f02e71a79378f79546b1a486ee1acc625af1dc
Instruction ID: 274392de247c1730f4be4354a019e79aff1dfa3cfa967041a4121367f2d45da7
Opcode Fuzzy Hash: 029115c63d01b8931fc3f8d786f02e71a79378f79546b1a486ee1acc625af1dc
Instruction Fuzzy Hash: 59115E712007009FC315EF29D4456AA7BA6EF813147108A29D1199F7A8DFB5ED8A8FD1

Function 028208F8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2383686655.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2820000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfa608df1a9e3b8f30785ecb55cfc3581d574912211b70eb4a7771598d6336ee
Instruction ID: c9e55f762913f5e67c509192b6256d8b9748e0e1a71c81a0368087fa5c5f6cfa
Opcode Fuzzy Hash: dfa608df1a9e3b8f30785ecb55cfc3581d574912211b70eb4a7771598d6336ee
Instruction Fuzzy Hash: C61113B59042598FDB20CFA9C484BDEBFF4AB48324F208459D459A7250C375A944CFA0

Function 02820900 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2383686655.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2820000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d539f00f52a3ed492e7317d1df58beade040b1c58aa81f503aa44e0df95a155e
Instruction ID: ed2439baab7d090b980d0018fdcf1028d67fa559d79bae35bbfa7c6f4265b3ad
Opcode Fuzzy Hash: d539f00f52a3ed492e7317d1df58beade040b1c58aa81f503aa44e0df95a155e
Instruction Fuzzy Hash: A41133B59002188FDB20DF9AC448BDEBBF4EB48324F208419D459A7210C375A984CFA0

Function 028276A8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2383686655.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2820000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de9e39cd5df1956fc1ebf1d28daf5c1cc62082e26346a04d80d1dfffc84c89e6
Instruction ID: 6f58e9b7e50116e339640eaf773639e9ca0920d4d90d2774a25f227aea5d5572
Opcode Fuzzy Hash: de9e39cd5df1956fc1ebf1d28daf5c1cc62082e26346a04d80d1dfffc84c89e6
Instruction Fuzzy Hash: 37017C38709255CFCB01EB3CD654229BBE1AF8A310F0148A9D4C9CB364DB34AC55DB86

Function 02820880 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2383686655.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2820000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c655a08e5a1823009ac4638540a7cb3a9e8571e4a05f82d9184a82baf598925
Instruction ID: 1e1ca8a2c2a72cd3626bd780aa1d61d893b73f3b2ce7f521067229d77dc2a991
Opcode Fuzzy Hash: 3c655a08e5a1823009ac4638540a7cb3a9e8571e4a05f82d9184a82baf598925
Instruction Fuzzy Hash: AC012879A08360AFCB09DB788C515EF3F73AF96254F1445AAD145DB2E2EA3284468781

Function 02820EA0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2383686655.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2820000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4248bde4b9bf3dff2d98a890b6683ab048989b77ef79f3ec208b4d84a761260
Instruction ID: 49a998bfb61e75e20712c58612e422cc725931448c875f38325a4e8a63b9423e
Opcode Fuzzy Hash: d4248bde4b9bf3dff2d98a890b6683ab048989b77ef79f3ec208b4d84a761260
Instruction Fuzzy Hash: 89F05C792083504FC3056F38A8500653FA2EE912443404ABAD049CF768DB65C88BC7D1

Function 02829620 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2383686655.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2820000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afddc555a9ebbb14cbfc05125f75d155454135daf5f035b9dd72c7c8717d9e8a
Instruction ID: 8c9675933e34c8767020babc150c6cdeddb1b80f51af7c3e799917dcddb16e6b
Opcode Fuzzy Hash: afddc555a9ebbb14cbfc05125f75d155454135daf5f035b9dd72c7c8717d9e8a
Instruction Fuzzy Hash: 08E08C3560A3988FC7492774B41E4A87FA0EBC6211B1100FAE149EB293EA69CC43C780

Function 02820839 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2383686655.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2820000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43fe0bd855c334cb3b08e7b6355792770a9a05f72e952208c74336e6cd78db84
Instruction ID: 6575e9361ca2898dda7177a68728c4053b697cd9822a0d892c558c222db2b5c5
Opcode Fuzzy Hash: 43fe0bd855c334cb3b08e7b6355792770a9a05f72e952208c74336e6cd78db84
Instruction Fuzzy Hash: 72E04F3410D3C85ECB03A738EC92B447F61AB43208F05479AD4888F37BD7A1454C8BE1

Function 028295F0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2383686655.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2820000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fd4fd7407ebadfbe815429580eebd9884291af0aaab88da047e8fa92f64e1a1
Instruction ID: 37fb3618a51c38e8c0f517b9a4f1b0914cc77cffde9f18fc2b49eb6c5ccb2255
Opcode Fuzzy Hash: 6fd4fd7407ebadfbe815429580eebd9884291af0aaab88da047e8fa92f64e1a1
Instruction Fuzzy Hash: 89D0A73164020C5BCB24FFB4941416EBAD9EB84100B0089D9944AC7244ED35EE404792

Function 02829630 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2383686655.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2820000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f3cc239656fc3ae9d8b7b031011bd8a54f3b034414e528d1b425697420c3d96
Instruction ID: 96ab5f96a4a5e418f9694047dbf1cc01af775e80ba99f9837307e3b54da6f27e
Opcode Fuzzy Hash: 3f3cc239656fc3ae9d8b7b031011bd8a54f3b034414e528d1b425697420c3d96
Instruction Fuzzy Hash: DCD0C9316023188BCB143A79B108469B6D9FBC912230004F9E50AC2340DE7AEC418780

Function 02820848 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2383686655.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2820000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6521e381430c2c5e4b60689abd2694b6bae7856833cf77722e751197b66c673
Instruction ID: 941b3070c2048903e8bf4154bf87a3e22c57cb77bf946ba28fd925e3c2f0b0e1
Opcode Fuzzy Hash: d6521e381430c2c5e4b60689abd2694b6bae7856833cf77722e751197b66c673
Instruction Fuzzy Hash: 2CD05E300087458ECA42FB18F8467017F58AB01208F004250D0084F33DE7A054888BE0

Analysis Process: Server.exePID: 5672, Parent PID: 1044COMMON

Executed Functions

Function 00E944A0 Relevance: 2.6, Strings: 2, Instructions: 100COMMON

Download Yara Rule

Strings

4'^q, xrefs: 00E945C9
e, xrefs: 00E944DF

Memory Dump Source

Source File: 0000000E.00000002.3140140326.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e90000_Server.jbxd

Similarity

API ID:
String ID: e$4'^q
API String ID: 0-3851034693
Opcode ID: 0f761ca21631440174c9797adb06f4030d790f177b32e80487e1085a7415c70a
Instruction ID: 98ecc4901222853cd4207efe6e0510aaf5e43b2f120df8b4b2d54ab534120548
Opcode Fuzzy Hash: 0f761ca21631440174c9797adb06f4030d790f177b32e80487e1085a7415c70a
Instruction Fuzzy Hash: 8C313571A012159FCF01EFA8D544AAEB7F1EF80708F5285A5D815AB3E6DB30DD0A8BD1

Function 00E98550 Relevance: 1.7, Strings: 1, Instructions: 494COMMON

Download Yara Rule

Strings

jt, xrefs: 00E988B9

Memory Dump Source

Source File: 0000000E.00000002.3140140326.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e90000_Server.jbxd

Similarity

API ID:
String ID: jt
API String ID: 0-2244888033
Opcode ID: c4149f9683546a7d6675af2121f8c951927fad82cc3917a05ccc52d234ab39d8
Instruction ID: ea99c2487411d7cc8733869bb914f27b329d44bfde50d7cb6e5cf4b4e2c2341f
Opcode Fuzzy Hash: c4149f9683546a7d6675af2121f8c951927fad82cc3917a05ccc52d234ab39d8
Instruction Fuzzy Hash: 81027D3A6542005FDA62FB10DF93B1DB7A1E7A0318F904911E108AB7FFCBB9AC458E55

Function 00E93AA0 Relevance: 1.7, Strings: 1, Instructions: 459COMMON

Download Yara Rule

Strings

dbq, xrefs: 00E93D85

Memory Dump Source

Source File: 0000000E.00000002.3140140326.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e90000_Server.jbxd

Similarity

API ID:
String ID: dbq
API String ID: 0-1887291361
Opcode ID: b1720833e551d364ab23ad9547a054f512dd4bb5f8e96effd9b0c6e2d3b28db9
Instruction ID: f34f3a8f939283158d35e312f9ba5470663773f5b423820d2fbe2f29464cb17e
Opcode Fuzzy Hash: b1720833e551d364ab23ad9547a054f512dd4bb5f8e96effd9b0c6e2d3b28db9
Instruction Fuzzy Hash: 27222978A00214CFDB15EF25DD94BA9BBB2FB88308F1045A9E509AB3E5DB359D85CF40

Function 00E93D24 Relevance: 1.6, Strings: 1, Instructions: 305COMMON

Download Yara Rule

Strings

dbq, xrefs: 00E93D85

Memory Dump Source

Source File: 0000000E.00000002.3140140326.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e90000_Server.jbxd

Similarity

API ID:
String ID: dbq
API String ID: 0-1887291361
Opcode ID: 5df5fef3bc9ff6f1e70c24ae690aca8fe47876a0d76f378453c1c3d1570c94f1
Instruction ID: bb9eeeecbdc4ae1163ed57c8b1564a27c58576103020f24f59b2fa84e4395cfa
Opcode Fuzzy Hash: 5df5fef3bc9ff6f1e70c24ae690aca8fe47876a0d76f378453c1c3d1570c94f1
Instruction Fuzzy Hash: E7E11978A01214CFDB15EF31D994BA9BBB2FF88304F1044A9E509AB3A5DB359D85CF50

Function 00E932A8 Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

Te^q, xrefs: 00E933EA

Memory Dump Source

Source File: 0000000E.00000002.3140140326.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e90000_Server.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: de27640db3ba9fa0344501f5377a95c9e9895c7f9bc58f296a2ed2ad64ad3ee4
Instruction ID: 31bcf4a7ef99af4fd6d54dbbfeb7bbd8ff14e56a4ba507ba8c6b21ea3b0b12c7
Opcode Fuzzy Hash: de27640db3ba9fa0344501f5377a95c9e9895c7f9bc58f296a2ed2ad64ad3ee4
Instruction Fuzzy Hash: 28510D786411458FDB01FF68FB91959BBE1FB84308B009965D0049B7BFDB78AA49CF90

Function 00E932B8 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

Te^q, xrefs: 00E933EA

Memory Dump Source

Source File: 0000000E.00000002.3140140326.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e90000_Server.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: baeb24df76a1a28e17fb95c740e558bb249853c4d8fd73632043e7d80bd9f971
Instruction ID: 076841357b01ecf3879948073469ef09f888e4004594be350ec392114ce820cb
Opcode Fuzzy Hash: baeb24df76a1a28e17fb95c740e558bb249853c4d8fd73632043e7d80bd9f971
Instruction Fuzzy Hash: 80510D786011458FDB01FF68FB90949BBE1FB84308B009965D0049B7BFDB78AA49CF90

Function 00E98F60 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3140140326.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e90000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 129f21198859577d66f747a45852251078eafd7a4da792b5abf77c5924452a53
Instruction ID: e6250a8ab299b00a3172883cb754b8ff86df84ac2d35d1d8b44652763deb18a6
Opcode Fuzzy Hash: 129f21198859577d66f747a45852251078eafd7a4da792b5abf77c5924452a53
Instruction Fuzzy Hash: 9D31B030B103149FDB05FB78DA1176E7BEAAB88304F004468E009A73EADF399D468BD1

Function 00E90890 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3140140326.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e90000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f412570bd256592e9785eb283a71bd2760f61d37c2efc86b5b9815d3515395f
Instruction ID: f4da3b9df224d105ecd2a2979f86b10a74a5b585d2379d306e30f205a3ac3bda
Opcode Fuzzy Hash: 3f412570bd256592e9785eb283a71bd2760f61d37c2efc86b5b9815d3515395f
Instruction Fuzzy Hash: 9E316BB19003089FDF14DFA9D84579EBFF5EF89324F108869E515B7291D735A940CBA0

Function 00E90994 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3140140326.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e90000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a82eba0415089d1e8c97e283815a12e829a5e54e532dd03c350a776a7e32d25a
Instruction ID: f15d75637a60f8c26eb471c7785d06dffd7806a7497b14687f237ea4275373eb
Opcode Fuzzy Hash: a82eba0415089d1e8c97e283815a12e829a5e54e532dd03c350a776a7e32d25a
Instruction Fuzzy Hash: F9310FB0D01248DFDB24CFA9D584BCDBFF5AF49310F20802AE408BB265CBB5A945CB94

Function 00E909A0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3140140326.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e90000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aff6e64173bab029e472b0c08bb8118c4fc64c514d621124e36041b96c6c422e
Instruction ID: 3855d402038b092cde0673b29b800437950ac931416b9d6a1ec6d8f327145ee5
Opcode Fuzzy Hash: aff6e64173bab029e472b0c08bb8118c4fc64c514d621124e36041b96c6c422e
Instruction Fuzzy Hash: 4831EFB0D01248DFDB24CFA9D584BCDBFF5AF48314F24802AE408BB264DBB5A945CB94

Function 00E99A48 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3140140326.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e90000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba9680f7cb7afea21b97db9391ac010ccaab899bda9678d7dcf52e47e51af8e3
Instruction ID: c5bed199c2151ec56aa2df37ab4a8b01c99625d35ebcd38c7f4ada303f4c8282
Opcode Fuzzy Hash: ba9680f7cb7afea21b97db9391ac010ccaab899bda9678d7dcf52e47e51af8e3
Instruction Fuzzy Hash: 0221AE31D0021A9FCF10DFA8E8109EEBBB4EF89304F10042AD549B3251EB746A46CBD1

Function 00E9519A Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3140140326.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e90000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d687a89ab0edf041a7bb1bb91e50a3a624e84fcac567597182791961412e2313
Instruction ID: 8223d0ba7f1a7b418e4285322cbda44e76ed8d7b5d5b7fc784886607a3f6b90c
Opcode Fuzzy Hash: d687a89ab0edf041a7bb1bb91e50a3a624e84fcac567597182791961412e2313
Instruction Fuzzy Hash: C521AF3490010A9FCB00FFA9EA565BEBBB1EF85310F010528D115B73E5DF30AA49CBA1

Function 00E951A8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3140140326.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e90000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca4bf4f842996a11b50edcf031a7b497d1557f2096d9fabc5d593da44fcdcc72
Instruction ID: b72f014bb1ac8922fd365a7cb0a9cd1d128bd2669fc750cc0187493bb677492f
Opcode Fuzzy Hash: ca4bf4f842996a11b50edcf031a7b497d1557f2096d9fabc5d593da44fcdcc72
Instruction Fuzzy Hash: D311603490010A9FCB00FFA9EA565BEBBB5EF85314F414528D119B73A5DF30AA49CFA1

Function 00E956C0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3140140326.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e90000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f809fec6359087cc6a0963648121c2c55402df1d251f7e878294cebabb7beeec
Instruction ID: 3e0d64b31668788688c0fc1f1f8741a0273009ec5e5254bc2bcfe4a04f43d215
Opcode Fuzzy Hash: f809fec6359087cc6a0963648121c2c55402df1d251f7e878294cebabb7beeec
Instruction Fuzzy Hash: D51143B19002489FCB60DF99C548BDEBFF8EB49320F208419E858B7290C774A944CFA4

Function 00E90DE0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3140140326.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e90000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c67da5e955276c2782a434aa53d364d4c6f55181a2585b00a4feba48f667cdd4
Instruction ID: 404b31a402285d0f7a4f637abb53b7a9b308a12c078d40622649d7a74ed34200
Opcode Fuzzy Hash: c67da5e955276c2782a434aa53d364d4c6f55181a2585b00a4feba48f667cdd4
Instruction Fuzzy Hash: AF11AC712003009FC318FB2AD5056AA7BE6AB81318700892DD01A9F7A8DFB5ED4A8FD1

Function 00E98D38 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3140140326.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e90000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbfc2c1af86fbefaad02d7d3542750fd4ec0d275b55f80c2cc4dac6f347ef758
Instruction ID: 512fb2d793ac757169a5476ff57e71671d70c04bdcd0f34ded2a4538fc71e539
Opcode Fuzzy Hash: bbfc2c1af86fbefaad02d7d3542750fd4ec0d275b55f80c2cc4dac6f347ef758
Instruction Fuzzy Hash: 1C1125B5800248CFCB20DF99C548BDEBBF4EF48324F20881AE558B7260C774A944CFA0

Function 00E908F8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3140140326.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e90000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c90b34bd05b38279bcb63cb3f8d3d791d1c55def6371f733bb67becb6baad2e2
Instruction ID: 477a99c5f73d4a945e3984754240437ab08b49992af604d8a33eb6d5a4619c55
Opcode Fuzzy Hash: c90b34bd05b38279bcb63cb3f8d3d791d1c55def6371f733bb67becb6baad2e2
Instruction Fuzzy Hash: 281122B19002498FCB20DF9AC488BDEFFF4EB88324F20845AD458A7211C375A940CFA5

Function 00E90900 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3140140326.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e90000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f174d0e405edf0f5b92a6ce6cb7341afc5114b8dc736577e2adcf15f38c21a21
Instruction ID: 9862979463da64008285cddffb2f8c748e58446ce5885d632d5d3e69e89fbad9
Opcode Fuzzy Hash: f174d0e405edf0f5b92a6ce6cb7341afc5114b8dc736577e2adcf15f38c21a21
Instruction Fuzzy Hash: 7E1100B59002498FDB20DFAAC448BDEBBF4EB88324F208419D559A7251C375A944CFA5

Function 00E98DD8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3140140326.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e90000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bd7b537465a0ebd778946bdf8243f02964775c521dd1e97d9234cc89b5f71bc
Instruction ID: 6f8b43e9c01f694da5859534db61bd55a5341a1d1d715b0f250483e02da55c0e
Opcode Fuzzy Hash: 7bd7b537465a0ebd778946bdf8243f02964775c521dd1e97d9234cc89b5f71bc
Instruction Fuzzy Hash: D901AD70708205CFCB01EB7CD65021E7BE1AF89310F421869D489DB360DA34ED058B82

Function 00E98DE8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3140140326.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e90000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 098353d4f678a7feb169127801ecbdd5d7e2cc906579c4ff18b38f7edb1a355c
Instruction ID: f417deab6d56be26b2995ef77bac8c0e70e57385b26421f9e793d802a3cb3986
Opcode Fuzzy Hash: 098353d4f678a7feb169127801ecbdd5d7e2cc906579c4ff18b38f7edb1a355c
Instruction Fuzzy Hash: DF013730705215CFCB44EB3CDA54A1EB7E1AF8A710F415869E58ADB364DB34ED418B86

Function 00E90EA0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3140140326.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e90000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b06fa15036aa2b6df2283e2b7174462252952203c1a35643bd51d1fb08e7951b
Instruction ID: e86ad29ef6b5c263c675757fc62006a6968bdd65569e08a4b52a411d9d48881a
Opcode Fuzzy Hash: b06fa15036aa2b6df2283e2b7174462252952203c1a35643bd51d1fb08e7951b
Instruction Fuzzy Hash: B0F05C717082008FC7055B78A8100A93FA2EAC135538009BAD04ACF774DB64CD4BC7D1

Function 00E99A38 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3140140326.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e90000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30ec330af2424b439b6ba809ab3ffe4180ef69e3663fab08bdf46095ea226888
Instruction ID: 75709a58e6ee0d03dcd3e17133515d8ef41532d5d8fca76c4c2b082319ff8fab
Opcode Fuzzy Hash: 30ec330af2424b439b6ba809ab3ffe4180ef69e3663fab08bdf46095ea226888
Instruction Fuzzy Hash: 2AD0A7B3F5406147E701019CA6293BE564DCFC5356F0B107BD90CFBA93E9958C435395

Function 00E99128 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3140140326.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e90000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b4a49cf4bef7ab4e3a2173bbda3f0e53ca38829131cfcab619bd845af004bb1
Instruction ID: 874e624b49e6f30bef2c468c863050f426e64c1cc93b4ccdcbc1efcd7b0c8d61
Opcode Fuzzy Hash: 4b4a49cf4bef7ab4e3a2173bbda3f0e53ca38829131cfcab619bd845af004bb1
Instruction Fuzzy Hash: 28E02BB1E081485BCB90DBF86E152AF7FD0FF41302F110EAAA44ACB180ED34CA000743

Function 00E99167 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3140140326.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e90000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7defdd50dac70b4866f43a15adfeb5f37c1a69614bff859c7cecb2e6815afbf2
Instruction ID: fa8869cb0ea86d25ef25a4a5f812d3b5b6732b3113a000e74da1387dbe0a6601
Opcode Fuzzy Hash: 7defdd50dac70b4866f43a15adfeb5f37c1a69614bff859c7cecb2e6815afbf2
Instruction Fuzzy Hash: 1AD05E75A04101CBCB041B78F58A3993FE4EB4431AF018475F219D7246CE3988228B80

Function 00E99138 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3140140326.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e90000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0753648e0c5fcedbec0f0f05fd6ea81c93071972d3e74f7a11674b6775ff738e
Instruction ID: 46bb3d349e6c599118e3ceff79a20554477e5c2d3e9d47b1b7679e39d730ac53
Opcode Fuzzy Hash: 0753648e0c5fcedbec0f0f05fd6ea81c93071972d3e74f7a11674b6775ff738e
Instruction Fuzzy Hash: E5D0A73060020C5BCB14EBB8581546E7BE9EB45200B404959A84ACB204ED318B000793

Function 00E90848 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3140140326.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e90000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be7e25c70093211206f24d2e5cfcdfc0322431348ee0a09d332c1fa06f3bb406
Instruction ID: 7f2a9d5fc464a9b033ec7818291a8553fbdd00989c5d3ed88062945de83db408
Opcode Fuzzy Hash: be7e25c70093211206f24d2e5cfcdfc0322431348ee0a09d332c1fa06f3bb406
Instruction Fuzzy Hash: 61D05EB42042458ECB41FB19FA057017F94A351208F000150D0081B6FAC7A8550D87D0

Analysis Process: Server.exePID: 8, Parent PID: 1044COMMON

Executed Functions

Function 029B86E8 Relevance: 1.8, Strings: 1, Instructions: 505COMMON

Download Yara Rule

Strings

jg, xrefs: 029B8DED

Memory Dump Source

Source File: 0000000F.00000002.3723363890.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b0000_Server.jbxd

Similarity

API ID:
String ID: jg
API String ID: 0-3345137040
Opcode ID: c9caffc7f9b6e9cb3c8efc4932ac51153634eaa3139c11a844b33c855b6e67aa
Instruction ID: c0ced7052fb02868d0d7cb9eadb15b67710930e80d4ba7e8120579c186e32bf5
Opcode Fuzzy Hash: c9caffc7f9b6e9cb3c8efc4932ac51153634eaa3139c11a844b33c855b6e67aa
Instruction Fuzzy Hash: 42028E396592506FD662F710DFD3B88772AEBA8701F904A31D6049F39CCB74ACD18E46

Function 029B4D09 Relevance: 1.7, Strings: 1, Instructions: 456COMMON

Download Yara Rule

Strings

dbq, xrefs: 029B4FED

Memory Dump Source

Source File: 0000000F.00000002.3723363890.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b0000_Server.jbxd

Similarity

API ID:
String ID: dbq
API String ID: 0-1887291361
Opcode ID: 6b2b49270066e00a454fed426ca38cfa35aea313b97aeeb2ab3038e3cee27db4
Instruction ID: cc87b71f5bbebf8a9e82c5f18a39dc6bb6f54efbd4a599e9867a8309852acbb2
Opcode Fuzzy Hash: 6b2b49270066e00a454fed426ca38cfa35aea313b97aeeb2ab3038e3cee27db4
Instruction Fuzzy Hash: FC227A34A01214CFDB25EF34D995BA97BB2FF48301F1045A9E949AB398DB32AD91CF40

Function 029B4F8C Relevance: 1.6, Strings: 1, Instructions: 305COMMON

Download Yara Rule

Strings

dbq, xrefs: 029B4FED

Memory Dump Source

Source File: 0000000F.00000002.3723363890.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b0000_Server.jbxd

Similarity

API ID:
String ID: dbq
API String ID: 0-1887291361
Opcode ID: 213b6fbdd8db1a8eae07c1017ac6b08b863e0e4671e82b1d97fe4f8a565e0205
Instruction ID: 479f3b817031fc1004892d766527fdcb105fcd6bc1d431d47966da9c16ea449c
Opcode Fuzzy Hash: 213b6fbdd8db1a8eae07c1017ac6b08b863e0e4671e82b1d97fe4f8a565e0205
Instruction Fuzzy Hash: 23E10674A01218CFDB26EF34D995BA9BBB2FF88305F1041A9D44AAB354DB35AD81CF41

Function 029B32A9 Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

Te^q, xrefs: 029B33EA

Memory Dump Source

Source File: 0000000F.00000002.3723363890.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b0000_Server.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 2a0a2aa90b8c9557b543951af396001697ecb6fcb6bd23b15a1ae59936a6a7d7
Instruction ID: e526a4e0a9ab2f7182c20bbc21e774591522ea58953ada08ecb355d87326f7a9
Opcode Fuzzy Hash: 2a0a2aa90b8c9557b543951af396001697ecb6fcb6bd23b15a1ae59936a6a7d7
Instruction Fuzzy Hash: E0512F3454A2458FCB06FF6CF982A49BBB2FB44705B009A65D0449F32DDB70A9A9CF91

Function 029B32B8 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

Te^q, xrefs: 029B33EA

Memory Dump Source

Source File: 0000000F.00000002.3723363890.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b0000_Server.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 6a9ce563aa721ea6d823d56923cf30ec43e1bd66c9a496a6891d7019e7071d43
Instruction ID: f5f40bfb467df023465344d9b3b804da8b7c62b628ed2d73edb17052bf6f4183
Opcode Fuzzy Hash: 6a9ce563aa721ea6d823d56923cf30ec43e1bd66c9a496a6891d7019e7071d43
Instruction Fuzzy Hash: DF512E3464A2058FCB06FF6CF982949BBB2FB44705B009A65D0449F32DDB70A9A9CF91

Function 029B0DCF Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

4'^q, xrefs: 029B0DA8

Memory Dump Source

Source File: 0000000F.00000002.3723363890.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b0000_Server.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 2dca2576d3ac145289f8a2935d35bcd312e9055cb41128292c75240c45bca190
Instruction ID: 744ba906c520f4f62ca0e7e94197471ef1261b7a46be1ab919a1050220846b5d
Opcode Fuzzy Hash: 2dca2576d3ac145289f8a2935d35bcd312e9055cb41128292c75240c45bca190
Instruction Fuzzy Hash: CB31D3306053059FC716EB38D941AAEBBA6FF81304B404969D0458F7A9DF75ED8ACB82

Function 029B9211 Relevance: .5, Instructions: 502COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3723363890.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69bceba37c8f785bfc4e7c36feb390f715017580053dc6b24a80df467332e722
Instruction ID: 3c032ff8981fc933d0406854d0f1ffb254a08e9056fe8db0c4cbd7b304778896
Opcode Fuzzy Hash: 69bceba37c8f785bfc4e7c36feb390f715017580053dc6b24a80df467332e722
Instruction Fuzzy Hash: 2EE048315483C44FCB16D7B4552525A3FF0AF06205B0589DED4868F162D9359E00D746

Function 029B41B0 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3723363890.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9141484aced5394a59ee646f8699b58bf0524f6643eb43590cbd1093f0e6dad
Instruction ID: 178e5138949fdb44c432600e78626c1a29e93244f3f3763b5055deabdb2b666b
Opcode Fuzzy Hash: f9141484aced5394a59ee646f8699b58bf0524f6643eb43590cbd1093f0e6dad
Instruction Fuzzy Hash: 8441A330B002059FDB16BB78E9557AF7BAAEB84700F004468D149D7398CF3A9D958B91

Function 029B4189 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3723363890.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abb7d8e82d520cdc2bbe137bd62f55eee4b004de4d08c8cdc83d9c7103f404f4
Instruction ID: 4284db547d1c0007c24e4bf15090208bd963d19cee4b80e1498f45b00ffeccc6
Opcode Fuzzy Hash: abb7d8e82d520cdc2bbe137bd62f55eee4b004de4d08c8cdc83d9c7103f404f4
Instruction Fuzzy Hash: B431E730B002049FDB16BB74E95577E3BABEF84700F104469D1859B3A8CE3ADC968B92

Function 029B41C0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3723363890.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6380a83f3cb378fbc9fc32d0f57ab2f19efff41e8e8e780c6cfcbd616524e9ea
Instruction ID: 9d0593b2c21004679af096d1357326d71b3291a9a24bcfb576d2a53e06d20d12
Opcode Fuzzy Hash: 6380a83f3cb378fbc9fc32d0f57ab2f19efff41e8e8e780c6cfcbd616524e9ea
Instruction Fuzzy Hash: C631C030B002059FDB16BB78E9557AF7BAAEB84700F004428D149DB3A8CF3ADD958B91

Function 029B0890 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3723363890.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0d53ad807e7700ace862c12ed1047106447e4dd859b20c473698b50dd395bee
Instruction ID: 78033a82e0c63a4b0672dd16d97004019b59fa2705670a8c741fb1700c088458
Opcode Fuzzy Hash: e0d53ad807e7700ace862c12ed1047106447e4dd859b20c473698b50dd395bee
Instruction Fuzzy Hash: 1631A9B19003089FDB14DFB9C8456DFBFF5EF88324F20886AD118A7290D736A941CB90

Function 029B0994 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3723363890.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb8fb79cdc44fb6247000313727f703c82bc41b25e07502d418da53e4c7137fb
Instruction ID: d9f6f5a73ebba2c3c97a40de7607fa07198065f7dea589ac8f5ac43e53bfc38d
Opcode Fuzzy Hash: eb8fb79cdc44fb6247000313727f703c82bc41b25e07502d418da53e4c7137fb
Instruction Fuzzy Hash: F73104B0D01248DFDB14CF99D584BCEBFF5AF49310F24806AE409BB254CB75A945CB94

Function 029B09A0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3723363890.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82bc21a2f540edf52f5ef63ea2efdf6fb40cc05719fe3f9f7af0cc4255e6dff6
Instruction ID: 553de38c9c70d51cde95428aef758db10f6460fe79186fd9edbdff3e61931e31
Opcode Fuzzy Hash: 82bc21a2f540edf52f5ef63ea2efdf6fb40cc05719fe3f9f7af0cc4255e6dff6
Instruction Fuzzy Hash: 0B31D0B0D01248DFDB14CF99D688BCEBBF5AF49310F24846AE409BB264CB75A945CB94

Function 029B8EF1 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3723363890.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7f85f80f1914cb3596f3c10e87a3f25ce2ab723013521815be9ebf038f26a95
Instruction ID: 99058548ea171a13c9cfc30f04954ff3001f2d0f03752c2e8a0c1c122c8255bb
Opcode Fuzzy Hash: b7f85f80f1914cb3596f3c10e87a3f25ce2ab723013521815be9ebf038f26a95
Instruction Fuzzy Hash: 6C2157B5A002198FCB11DFACD648BDEBBF5BF48320F108829E499AB254C735A944CF91

Function 029B40A7 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3723363890.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8343848e75d0964d844aaeca09bc0837a741c1a7edc0bc9bcf8b56760c50ed82
Instruction ID: a43135ed713fd9e7c401fe10614b071b85138d264c35bf9bb017666c22500a4f
Opcode Fuzzy Hash: 8343848e75d0964d844aaeca09bc0837a741c1a7edc0bc9bcf8b56760c50ed82
Instruction Fuzzy Hash: 7A21D734D052099FCB02EB68E8515AEBBB1FF85304F00857ED145AB3A9DF319A58CF51

Function 029B9AF0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3723363890.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be68e456fe00ddfafb93eebb747f8ba960ba3103851252fd2f4f4ea6268fa581
Instruction ID: eb59d2a42fc09c99147e006a13e0f77713dac631505feb72e4bddeb446ff70b6
Opcode Fuzzy Hash: be68e456fe00ddfafb93eebb747f8ba960ba3103851252fd2f4f4ea6268fa581
Instruction Fuzzy Hash: D2014932B002204BD716562DB5247A97B9ECFC6321F04007BEA09DB350CE658C02CB90

Function 029B48E7 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3723363890.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 915a6a8b515fdcf8d655f0b35077d88dc1e711470e7eae0711a6912cbedb9b58
Instruction ID: d40bf0d91c8654ef60d45db72d5bf8032ac1bb795c75d30964d2e12d10114bac
Opcode Fuzzy Hash: 915a6a8b515fdcf8d655f0b35077d88dc1e711470e7eae0711a6912cbedb9b58
Instruction Fuzzy Hash: A21156B59003488FCB10DF99D548BDEBBF4FF48320F108429D499A7211C775A944CFA4

Function 029B40B8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3723363890.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4599884fed4c172ea7c1af96c5992f7d11a112e836b8865a101ac0f1c8e32fa6
Instruction ID: 4a4b4284703782265217e1a9b54cf76d33934a83bd66d6e21ef6a176d9681876
Opcode Fuzzy Hash: 4599884fed4c172ea7c1af96c5992f7d11a112e836b8865a101ac0f1c8e32fa6
Instruction Fuzzy Hash: 0D112434D001099FCB01EFA8E8959ADBB75FF84305F00453AD105A73A9DF35AA98CB51

Function 029B08F8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3723363890.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95fae17272cf2faf45ba5e219d2669f426cd8755ae099d1e55658631035ca198
Instruction ID: 297cbdc89ba5db6709eda8190b8ab510added28d616bfe4ae981dc225da164a6
Opcode Fuzzy Hash: 95fae17272cf2faf45ba5e219d2669f426cd8755ae099d1e55658631035ca198
Instruction Fuzzy Hash: 7A1152B19003488FCB20DFAAC544BDFBFF4EB48324F20845AD858A7211C335A944CFA0

Function 029B48F4 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3723363890.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 698eea632bb270e685f46eaa5fe5280d7a1b73014d1fe2a91f9116e85eb7b041
Instruction ID: 11cf60c110b786f697904d2e71f31231ea53c8e23bd80a0ad6078237eaa483fc
Opcode Fuzzy Hash: 698eea632bb270e685f46eaa5fe5280d7a1b73014d1fe2a91f9116e85eb7b041
Instruction Fuzzy Hash: F01102B59002598FDB20DF99D548BDEBBF8FB48320F108429E559A7250C775A944CFA4

Function 029B0DE0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3723363890.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a1939a32ee9117d9d2198dcda67b354bdc1e6a217c4e19ab7ac1d016f050b39
Instruction ID: 3800887871786ff4f20197f1410758fc0f8b55a3dc3c0cea4e87522c540bc532
Opcode Fuzzy Hash: 3a1939a32ee9117d9d2198dcda67b354bdc1e6a217c4e19ab7ac1d016f050b39
Instruction Fuzzy Hash: ED11A0312003006FC316EB29D5015AB7BDAAF81314740492DC15A8F7A8DFB6ED8A8FC2

Function 029B0900 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3723363890.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08fe4485e6ababf2defd9034343deff0d3d75c0b585ed8e8aab1ce5c2d69c5f5
Instruction ID: 64d904499d492059845320e42d5149322666942aeeaf5b6b9cb926762ffc86d4
Opcode Fuzzy Hash: 08fe4485e6ababf2defd9034343deff0d3d75c0b585ed8e8aab1ce5c2d69c5f5
Instruction Fuzzy Hash: 721100B59003598FDB20DFAAC544BDFBBF4EB48324F208459D459A7250C375A944CFA5

Function 029B8F90 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3723363890.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54f62161e2d3bd4c68694275570b7ebbdd28ce04bf9d215ae12b202aaee18f84
Instruction ID: 3b5c2fcd66fbfcbf041b2e3c489da4ad2762dd1c10a5bb629b5612329f8492c9
Opcode Fuzzy Hash: 54f62161e2d3bd4c68694275570b7ebbdd28ce04bf9d215ae12b202aaee18f84
Instruction Fuzzy Hash: 8A018F307092508FCB02AB3CD65462E7BF5AF8A310F4548AAE0C5CB365DB34DD41CB86

Function 029B0EA0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3723363890.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26581d0ef792dbd04ed95f632e516fd9a5f06517bd5d07cff90b6aa5510a5673
Instruction ID: b82e966dce828da27333d66dfdebd4aca434f9e1bce8ac406f90f5ad2cb51a34
Opcode Fuzzy Hash: 26581d0ef792dbd04ed95f632e516fd9a5f06517bd5d07cff90b6aa5510a5673
Instruction Fuzzy Hash: 46F05C317053004FC3076B78A9510E67BA2FD8124134009BAD189CF2A8DB69D847C381

Function 029B9AE1 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3723363890.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcc8298a839d7066b746996ff99634ce6127f01858bbb54baf703c2b11f69df1
Instruction ID: 6e698a5cb7494d2e69624b8132ff4b53e1d0ffce1d3f5ede7f1bec72093e6f7b
Opcode Fuzzy Hash: dcc8298a839d7066b746996ff99634ce6127f01858bbb54baf703c2b11f69df1
Instruction Fuzzy Hash: CBD0C222A206A013E621125D76303B66F9D8BC3358F041072EA4887322CC495C4293D1

Function 029B9617 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3723363890.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae807ffccf963280656985db6a275e2eafd7442d9698539a029e107d320576dd
Instruction ID: 24b8efe77e31b637ba0d1715e751093b3203cbb8526e048a075bc5e23eb926e0
Opcode Fuzzy Hash: ae807ffccf963280656985db6a275e2eafd7442d9698539a029e107d320576dd
Instruction Fuzzy Hash: DAE0C2312183849FC7022778A43A0EABFBCDB4A342F0014ABF4468B712DD35A802CB61

Function 029B0839 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3723363890.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2774140a0e99ab3e1e941d7951ec4733c5d25e31c762ea145a35dcb7927f4d70
Instruction ID: e0dac3ebced619525e28b26b1a1acbd3048584527bc9f17d44ab82cb2f5c485a
Opcode Fuzzy Hash: 2774140a0e99ab3e1e941d7951ec4733c5d25e31c762ea145a35dcb7927f4d70
Instruction Fuzzy Hash: C6E01A3004D3858FC713EB68E952B017FA4EB02304F0505A6D0848F26BD76969A98796

Function 029B95E8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3723363890.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a876ed91287a8a3565994f06e1d5d83a05844a29941518b5a547a95a3404520
Instruction ID: 8fadfe4cb201a766d9b653a01fb342e075e911d3fd6a84fe44a34902c7956353
Opcode Fuzzy Hash: 8a876ed91287a8a3565994f06e1d5d83a05844a29941518b5a547a95a3404520
Instruction Fuzzy Hash: 25D0A730A0030C5BCF14EBB8442506E7FE9EB44204B404999A80BD7244ED31DE000792

Function 029B9628 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3723363890.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 913f65eff1297c5c60043c71a963862855f94d665d7f11007c96b3e8c03438b3
Instruction ID: 251058efbc719a636f06b2643e7736eb25e794c31157df445dfec62e2a4a9730
Opcode Fuzzy Hash: 913f65eff1297c5c60043c71a963862855f94d665d7f11007c96b3e8c03438b3
Instruction Fuzzy Hash: 64D012317203189BC7142BB8A42D059BFEDEB49356700147BF40BC7300DE76E8028B90

Function 029B0848 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3723363890.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b0000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faacf5bb174c6b7127459ed1d7a7509bf0e10114d84e45f7a1324fa9d28b629c
Instruction ID: 0311c040514bd176264e1360cb9d639ecca6103e42d7f3233f897853a8377b61
Opcode Fuzzy Hash: faacf5bb174c6b7127459ed1d7a7509bf0e10114d84e45f7a1324fa9d28b629c
Instruction Fuzzy Hash: CDD0C7301492858ECB63FB18F5477057F55E750305F410564D1884F32DDBBA65AD87D9

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report oiA5KmV0f0.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Njrat

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

E-Banking Fraud

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Dllhost.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Java update.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Server.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\oiA5KmV0f0.exe.log

C:\Users\user\AppData\Local\Temp\Server.exe

C:\Users\user\AppData\Roaming\Dllhost.exe

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
oiA5KmV0f0.exe